CVE-2021-21064CWE-22

Magento UPWARD-php Path traversal vulnerability via UPWARD Connector

Medium · published February 25, 2021

CVSS v3.0
4.9
EPSS
9%
Percentile
95.0
In the wild
Unconfirmed
What it is

Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which allows reading arbitrary files from the remote server. Access to the admin console is required for successful exploitation.

The record
Technical detail
CVSS v3.0
4.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.08514 · 95.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-02-25T13:22Z
EPSS history
Timeline
  • 25 FEB 13:22Z
    Magento UPWARD-php Path traversal vulnerability via UPWARD Connector
    cvelistv5