CVE-2021-36043CWE-918

Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution

High · published September 1, 2021

CVSS v3.1
8.0
EPSS
2%
Percentile
80.0
In the wild
Unconfirmed
What it is

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01947 · 80.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2021-09-01T14:31Z
EPSS history
Timeline
  • 01 SEP 14:31Z
    Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution
    cvelistv5