Fix for arbitrary command execution in custom layout update through blocks

높음 7.2CVE-2021-39217 · GHSA-c9q3-r4rv-mjm7 · Published 27/01/2023 · updated 17/06/2026

요약

CVE-2021-39217은(는) openmage/magento-lts, magento (openmage)에 영향을 주는 높음 (CVSS 7.2) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.3%, 전체 취약점의 70.8%보다 높음.
조치: 20.0.19, 19.4.22 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
openmage/magento-lts Packagist	`≥ 20.0.0, < 20.0.19< 19.4.22`	`20.0.1919.4.22`
magento openmage	`≥ 20.0.0, < 20.0.19< 19.4.22`	`20.0.1919.4.22`

Description

Impact

Custom Layout enabled admin users to execute arbitrary commands via block methods.

NVD description

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.

References

OpenMage/magento-lts security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-39217 · ADVISORY
OpenMage/magento-lts commit 289bd4b · WEB
OpenMage/magento-lts · PACKAGE
OpenMage/magento-lts release v19.4.22 · WEB
OpenMage/magento-lts release v20.0.19 · WEB

openmage/magento-lts의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openmage/magento-lts

Packagist

≥ 20.0.0, < 20.0.19< 19.4.22

20.0.1919.4.22

magento

openmage

≥ 20.0.0, < 20.0.19< 19.4.22

20.0.1919.4.22

Description

Impact

Custom Layout enabled admin users to execute arbitrary commands via block methods.

NVD description

openmage/magento-lts의 다른 취약점

모두 보기 →