CVE-2021-39217: high-severity vulnerability in OpenMage magento-lts
OpenMage LTS arbitrary command execution in custom layout update through blocks
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 1.4%
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
OpenMage · magento-ltsRelated CVEs — OpenMage magento-lts
In the same product, most dangerous first.
CVE-2020-26285HIGHWidget instances allows a hacker to inject an executable file on the server on OpenMageEPSS 3.7%CVE-2020-26295HIGHCMS Editor code executionEPSS 2.2%CVE-2020-26252HIGHLayout XML RCE Vulnerability in OpenMageEPSS 2.1%CVE-2021-32758HIGHLayout XML Arbitrary Code FixEPSS 2.0%CVE-2021-32759HIGHData Flow Sanitation Issue FixEPSS 1.8%CVE-2021-41143HIGHOpenMage LTS arbitrary file deletion in customer media allows for remote code executionEPSS 1.3%