High severity · published Jan 27, 2023
CVE-2021-39217
OpenMage LTS is an e-commerce platform
7.2
CVSS
1.3%
EPSS
No
On KEV
Description
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Magento · Openmage
before 19.4.22; 20.0.0 before 20.0.19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39217
Patch
https://github.com/OpenMage/magento-lts/commit/289bd4b4f53622138e3e5c2d2cef7502d780086f
Release Notes
https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22
Release Notes
https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19
Third Party Advisory
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-c9q3-r4rv-mjm7
More from Magento
9.8
CVE-2021-21426
Magento-lts is a long-term support alternative to Magento Community Edition (CE)
8.8
CVE-2026-40488
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
8.8
CVE-2021-41144
OpenMage LTS is an e-commerce platform
8.1
CVE-2026-25524
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
7.5
CVE-2023-41879
Magento LTS is the official OpenMage LTS codebase