Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Magento Improper Access Control Vulnerability - CVE-2021-36036 - Vulnerability Database
Magento

Magento Improper Access Control Vulnerability - CVE-2021-36036

High
Reference: CVE-2021-36036
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2021-36036
Title: Magento Improper Access Control Vulnerability
Overview:

Magento versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento39s Media Gallery Upload workflow. By storing a specially crafted file in the website gallery an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.