CVE-2021-36020CWE-91

Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution

High · published September 1, 2021

CVSS v3.1
8.2
EPSS
3%
Percentile
85.9
In the wild
Unconfirmed
What it is

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02715 · 85.9th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2021-09-01T14:30Z
EPSS history
Timeline
  • 01 SEP 14:30Z
    Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution
    cvelistv5