CVE-2021-28566
low-risk
Published 2021-09-08
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Do I need to act?
-
0.54% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10
Low
NETWORK
/ HIGH complexity
Affected Vendors
References (2)
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb21-30.html
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb21-30.html
22
/ 100
low-risk
Severity
13/34 · Low
Exploitability
2/34 · Minimal
Exposure
7/34 · Low