DemoBook a demo

Vulnerability advisory

CVE-2021-32759

Published Updated OSV record ↗

Also known as GHSA-xm9f-vxmx-4m58

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/openmage/magento-lts ↗
All commits before f71321b37a782bd167ef56de0c6e18e67645685df71321b37a782bd167ef56de0c6e18e67645685d
16c8e84ddaf5d54eef1e025a241bdd5f9a60bd6f to before c5a24f77af6780913b7ff05f9e50c6486f7891fcc5a24f77af6780913b7ff05f9e50c6486f7891fc
Not specified4885b20d86bba7aa200007a76620575488e25846
Not specifiedff6189ae82f141c13224318241be64d512555c0d
Also listed as affected (78)
  • v20.0.10
  • v20.0.8
  • v19.4.12
  • v20.0.7
  • v19.4.11
  • v20.0.6
  • v19.4.10
  • v20.0.5
  • v19.4.9
  • v20.0.4
  • v19.4.8
  • v20.0.3
  • v19.4.7
  • v20.0.2
  • v19.4.6
  • v20.0.1
  • v19.4.5
  • v20.0.0
  • v19.4.4
  • v19.4.3
  • v19.4.2
  • v19.4.1
  • v19.4.0
  • 1.9.0.1
  • 1.9.1.1
  • 1.9.1.0-lts
  • 1.9.0.0
  • 1.8.1.0
  • 1.7.0.2
  • 1.7.0.1
  • 1.7.0.0
  • 1.6.1.0
  • 1.6.0.0
  • 1.6.0.0-rc2
  • 1.6.0.0-rc1
  • 1.6.0.0-beta1
  • 1.6.0.0-alpha1
  • 1.5.1.0
  • 1.5.0.1
  • 1.5.0.0
  • 1.5.0.0-rc2
  • 1.5.0.0-rc1
  • 1.5.0.0-beta2
  • 1.5.0.0-beta1
  • 1.5.0.0-alpha2
  • 1.5.0.0-alpha1
  • 1.4.2.0
  • 1.4.1.1
  • 1.4.1.0
  • 1.4.0.1
  • 1.3.2.4
  • 1.4.0.0
  • 1.4.0.0-rc1
  • 1.4.0.0-beta1
  • 1.4.0.0-alpha3
  • 1.4.0.0-alpha2
  • 1.4.0.0-alpha1
  • 1.3.2.3
  • 1.3.2.2
  • 1.3.2.1
  • 1.3.2
  • 1.3.1.1
  • 1.3.1
  • 1.3.0
  • 1.2.1.2
  • 1.2.1
  • 1.2.0.3
  • 1.2.0.2
  • 1.2.0.1
  • 1.2.0
  • 1.1.8
  • 1.1.7
  • 1.1.6
  • 1.1.5
  • 1.1.4
  • 1.1.3
  • 1.1.2
  • 1.1.1

Description

OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.