同じ製品で同じ時期に公表された 3 件の脆弱性の 1 つです。まとめた解説: OpenMage Magento LTSに脆弱性3件、修正版が公開
OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options
概要
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom opti...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| OpenMagemagento-lts |
21.0.0-beta1 以上 21.0.0-beta3 未満→ 21.0.0-beta3 |
21.0.0-beta3 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.
出典: CVE.org (CVE Program・cvelistV5) NVD