CVE-2021-36024

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) Magento Commerce versions 2.3.7 (and earlier)

Description The issue is caused by an improper neutralization of special elements used in a command, allowing an attacker with admin privileges to upload a specially crafted file and achieve remote code execution via the "Data collection endpoint". This is due to insufficient input validation.

Recommendations For versions 2.4.2 and earlier, and 2.4.2-p1 and earlier, consider disabling the Data collection endpoint until a patch is available. For version 2.3.7 and earlier, restrict access to the Data collection endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the Data collection endpoint until the issue is resolved.