Magento Commerce information disclosure during upload action leveraging a specially crafted file
Résumé
Magento Commerce information disclosure during upload action leveraging a specially crafted file
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Magento versions 2.4.2 (and earlier), 2.4.1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory helpx.adobe.com
- web nvd.nist.gov