CVE-2021-36033

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 and earlier Magento Commerce versions 2.4.2-p1 and earlier Magento Commerce versions 2.3.7 and earlier

Description The issue is related to an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. The vulnerability is associated with errors in processing XML requests, which can allow a remote attacker to execute arbitrary code.

Recommendations For Magento Commerce versions 2.4.2 and earlier, update to a version that fixes the XML Injection vulnerability in the Widgets Module. For Magento Commerce versions 2.4.2-p1 and earlier, update to a version that fixes the XML Injection vulnerability in the Widgets Module. For Magento Commerce versions 2.3.7 and earlier, update to a version that fixes the XML Injection vulnerability in the Widgets Module. As a temporary workaround, consider restricting access to the Widgets Module to minimize the risk of exploitation.