GHSA-h632-p764-pjqm

DataFlow upload remote code execution vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2021-41231

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	openmage/magento-lts	< 19.4.22	19.4.22
Packagist	openmage/magento-lts	>= 20.0.0, < 20.0.19	20.0.19

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile.

References

External links from the advisory. They lead to third-party sites.

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-h632-p764-pjqm web
https://nvd.nist.gov/vuln/detail/CVE-2021-41231 advisory
https://github.com/OpenMage/magento-lts/commit/d16fc6c5a1e66c6f0d9f82020f11702a7ddd78e4 web
https://github.com/OpenMage/magento-lts package
https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22 web
https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19 web