Magento Information Disclosure vulnerability
The advisory, in context
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.4.0 before 2.4.2-p1
Fixed in 2.4.2-p1
5 explicitly affected versions
2.4.0, 2.4.0-p1, 2.4.1, 2.4.1-p1, 2.4.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.2-p1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.0",
"2.4.0-p1",
"2.4.1",
"2.4.1-p1",
"2.4.2"
]
}From 2.3.0 before 2.3.7
Fixed in 2.3.7
13 explicitly affected versions
2.3.0, 2.3.1, 2.3.2, 2.3.2-p2, 2.3.3, 2.3.3-p1, 2.3.4, 2.3.4-p2, 2.3.5, 2.3.5-p1, 2.3.5-p2, 2.3.6, 2.3.6-p1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.3.0",
"2.3.1",
"2.3.2",
"2.3.2-p2",
"2.3.3",
"2.3.3-p1",
"2.3.4",
"2.3.4-p2",
"2.3.5",
"2.3.5-p1",
"2.3.5-p2",
"2.3.6",
"2.3.6-p1"
]
}