Magento Commerce information disclosure during upload action… (CVE-2021-28566)

Summary

Magento Commerce information disclosure during upload action leveraging a specially crafted file

Original description

The description as published by the source.

Magento versions 2.4.2 (and earlier), 2.4.1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami magento

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.3"}]}]

References

advisory helpx.adobe.com
web nvd.nist.gov