CVE-2021-36035 Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code Execution

Critical 9.1 Published 1 Sep 2021 Updated 16 Sep 2024

An attacker with admin privileges can achieve remote code execution via improper input validation in the Adobe Stock API integration.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-36035?

CVE-2021-36035 is a critical code injection vulnerability in Adobe Magento Commerce, published on 1 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could make a crafted request to the Adobe Stock API to achieve remote code execution.

Weakness: CWE-20

Which versions are affected by CVE-2021-36035?

It affects 2 products.

Products include Adobe Adobe Commerce, Adobe Magento Open Source.

How do I fix CVE-2021-36035?

No fix has been published for CVE-2021-36035 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-36035 being exploited?

There is no known exploitation of CVE-2021-36035 in the wild and no public exploit code.

Sources

Also known as GHSA-6454-hgc7-888r.