CVE-2021-36042

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) Magento Commerce version 2.3.7 (and earlier)

Description The issue is caused by improper input validation in the API File Option Upload Extension. An attacker with Admin privileges can exploit this to achieve unrestricted file upload, potentially resulting in remote code execution.

Recommendations For Magento Commerce versions 2.4.2 (and earlier) and 2.4.2-p1 (and earlier), update to a version that fixes the improper input validation vulnerability in the API File Option Upload Extension. For Magento Commerce version 2.3.7 (and earlier), update to a version that fixes the improper input validation vulnerability in the API File Option Upload Extension. As a temporary workaround, consider restricting access to the API File Option Upload Extension until a patch is available.