Vulnerability advisory

CVE-2021-21018

Published Feb 11, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2021-21018GHSA-rv48-v862-mp92

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before 9eba2c99bed83d8297c03b7ea3b110500cc5b955	`9eba2c99bed83d8297c03b7ea3b110500cc5b955`
9eba2c99bed83d8297c03b7ea3b110500cc5b955 through 9eba2c99bed83d8297c03b7ea3b110500cc5b955	No fix listed
Also listed as affected (20) `2.3.6-NA` `2.3.0` `2.2.7` `2.1.16` `1.x-eos` `2.3.5` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before 53ad434d78cd2d357203fb82e5ea059883f403b8	`53ad434d78cd2d357203fb82e5ea059883f403b8`
53ad434d78cd2d357203fb82e5ea059883f403b8 through 445b0f1a3d6a91b5da32d311077c2112ef0b1503	No fix listed
Also listed as affected (37) `2.3.6-NA` `2.4.0-NA` `2.4.0-p1` `2.4.1-NA` `2.4.1` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb21-08.html ↗