Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2021-39217

OpenMage LTS arbitrary command execution in custom layout update through blocks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenMage magento-lts

  • < 19.4.22affected
  • >= 20.0.0, < 20.0.19affected

References