PT-2023-12376 · Unknown · Openmage Lts
CVE-2021-41231
·
Published
2023-01-27
·
Updated
2023-02-06
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenMage LTS versions prior to 19.4.22
OpenMage LTS versions prior to 20.0.19
Description
The issue allows an administrator with the permissions to upload files via DataFlow and to create products to execute arbitrary code via the convert profile.
Recommendations
For versions prior to 19.4.22, update to version 19.4.22 or later to resolve the issue.
For versions prior to 20.0.19, update to version 20.0.19 or later to resolve the issue.
Fix
Unrestricted File Upload
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openmage Lts