CVE-2021-36021

HIGH

Magento < 2.3.7-p1 - Authenticated Remote Code Execution via CMS Page Scheduled Update

Title source: llm
STIX 2.1

Description

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

References (1)

Core 1
Core References

Scores

CVSS v3 7.2
EPSS 0.0098
EPSS Percentile 77.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-20
Status published
Products (5)
magento/community-edition 0 - 2.3.7-p1Packagist
magento/magento 2.3.7 (2 CPE variants)
magento/magento 2.4.2 (4 CPE variants)
magento/magento < 2.3.7 (2 CPE variants)
magento/project-community-edition 0Packagist
Published Sep 06, 2023
Tracked Since Feb 18, 2026