~ / search / GHSA-36xq-7w8w-xp68

GHSA-36xq-7w8w-xp68

Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension

Source: GitHub Advisory Database (reviewed) High CVE-2021-36043

Packages

EcosystemPackageAffectedFixed in
Packagist magento/project-community-edition <= 2.0.2 no fix listed
Packagist magento/community-edition < 2.3.7-p1 2.3.7-p1
Packagist magento/community-edition 2.3.7 no fix listed
Packagist magento/community-edition >= 2.4.2-p1, < 2.4.2-p2 2.4.2-p2
Packagist magento/community-edition 2.4.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.

References

External links from the advisory. They lead to third-party sites.