Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2021-36043

High
8/10

Summary

Magento Commerce in versions prior to 2.3.7-p1, 2.4.2 prior to 2.4.2-p2 and magento/project-community-edition versions through 2.0.2 are affected by a blind Servers-Side Request Forgery (SSRF) vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve Remote Code Execution if Redis is enabled.

  • HIGH
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published