CVE-2021-21029

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-21029
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21029.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-21029
Aliases
Published
2021-02-11T20:15:14.763Z
Modified
2026-07-09T00:12:26.235541Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

References

Affected packages

Git / github.com/magento/devdocs

Affected ranges

Type
GIT
Repo
https://github.com/magento/devdocs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9eba2c99bed83d8297c03b7ea3b110500cc5b955
Introduced
9eba2c99bed83d8297c03b7ea3b110500cc5b955
Last affected
9eba2c99bed83d8297c03b7ea3b110500cc5b955
Database specific 
{
    "cpe": [
        "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.6"
        },
        {
            "introduced": "2.3.6-NA"
        },
        {
            "last_affected": "2.3.6-NA"
        },
        {
            "introduced": "2.4.1-NA"
        },
        {
            "last_affected": "2.4.1-NA"
        }
    ]
}

Affected versions

1.*
1.x-eos
2.*
2.0.8
2.1.14
2.1.15
2.1.16
2.1.17
2.1.18
2.2.11
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.3.0
2.3.1
2.3.2
2.3.3-p1
2.3.4
2.3.5
2.3.6-NA
2.3.6-p1
2.4.1-p1
2.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21029.json"

Git / github.com/magento/magento2

Affected ranges

Type
GIT
Repo
https://github.com/magento/magento2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
53ad434d78cd2d357203fb82e5ea059883f403b8
Introduced
53ad434d78cd2d357203fb82e5ea059883f403b8
Last affected
445b0f1a3d6a91b5da32d311077c2112ef0b1503
Database specific 
{
    "cpe": [
        "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.0:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.0:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.6"
        },
        {
            "introduced": "2.3.6-NA"
        },
        {
            "last_affected": "2.3.6-NA"
        },
        {
            "introduced": "2.4.0-NA"
        },
        {
            "last_affected": "2.4.0-NA"
        },
        {
            "introduced": "2.4.0-p1"
        },
        {
            "last_affected": "2.4.0-p1"
        },
        {
            "introduced": "2.4.1-NA"
        },
        {
            "last_affected": "2.4.1-NA"
        }
    ]
}

Affected versions

0.*
0.1.0-alpha100
0.1.0-alpha101
0.1.0-alpha102
0.1.0-alpha103
0.1.0-alpha104
0.1.0-alpha105
0.1.0-alpha106
0.1.0-alpha107
0.1.0-alpha108
0.1.0-alpha89
0.1.0-alpha90
0.1.0-alpha91
0.1.0-alpha92
0.1.0-alpha93
0.1.0-alpha94
0.1.0-alpha95
0.1.0-alpha96
0.1.0-alpha97
0.1.0-alpha98
0.1.0-alpha99
0.42.0-beta1
0.42.0-beta3
0.74.0-beta1
2.*
2.0.0
2.0.0-rc
2.1.0
2.1.0-rc1
2.1.0-rc2
2.1.0-rc3
2.2.0-RC1.1
2.2.0-RC1.2
2.2.0-RC1.3
2.3.6-NA
2.4.0-NA
2.4.0-p1
2.4.1
2.4.1-NA

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21029.json"