Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2021-36033: Magecom Versions 2.4.2 and Earlier Allow Admin Privilege Escalation
CVE-2021-36033 · published 5 years ago
Summary
Magento Commerce versions 2.4.2 and earlier have a security flaw that allows someone with admin access to gain more control. This could let an attacker run unauthorized code on your website, potentially causing damage or disrupting your business operations. To fix this, update to the latest version of Magento Commerce.
What to do
- Update magento community-edition to version 2.3.7-p1.
- Update magento community-edition to version 2.4.2-p2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | magento | project-community-edition | <= 2.0.2 |
| composer | magento | community-edition |
< 2.3.7-p1 2.3.7 >= 2.4.2-p1, < 2.4.2-p2 2.4.2 Fix: upgrade to 2.3.7-p1
|
| – | adobe | adobe_commerce |
>= 2.3.0, <= 2.3.7 >= 2.4.0, <= 2.4.2 2.4.2 cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* |
| – | adobe | magento_open_source |
>= 2.3.0, <= 2.3.7 >= 2.4.0, <= 2.4.2 2.4.2 cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:* |
Original advisory text
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges...
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
Severity
7.2
High
Type
CWE-91XML Injection (aka Blind XPath Injection)
Timeline
Published1 Sep 2021
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta