SB2021011929 - Multiple vulnerabilities in Magento LTS



SB2021011929 - Multiple vulnerabilities in Magento LTS

Published: January 19, 2021 Updated: April 20, 2026

Security Bulletin ID SB2021011929
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2020-26295)

The vulnerability allows a remote user to execute arbitrary code on the server.

The vulnerability exists due to improper access control in the CMS layout XML handling when processing layout XML in CMS page editing. A remote user can inject an executable file on the server to execute arbitrary code on the server.

Exploitation requires permissions to import or export data and to edit CMS pages.


2) Improper access control (CVE-ID: CVE-2020-26285)

The vulnerability allows a remote user to inject an executable file on the server.

The vulnerability exists due to improper access control in widget instances when importing or exporting data and creating widget instances. A remote user can use these permissions to inject an executable file on the server.

Exploitation requires administrative access with permission to import or export data and to create widget instances.


3) Improper access control (CVE-ID: CVE-2020-26252)

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in layout xml processing when updating product data. A remote user can store an executable file on the server and load it via layout xml to execute arbitrary code.


Remediation

Install update from vendor's website.