-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | < 2.3.6 | 2.3.6 |
| magento/community-edition | composer | >= 2.4.0, < 2.4.1-p1 | 2.4.1-p1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability exists in the scheduled operation module (cron), which is handled by Magento's Cron module. The execute method in Schedule.php is responsible for running cron jobs. The advisory indicates OS command injection via cron configurations, implying user-supplied data (like command parameters) was used unsafely in system commands. This function likely constructs OS commands using admin-controlled input without proper sanitization, leading to arbitrary code execution when malicious commands are injected. The confidence is high because this aligns with CWE-78 patterns and Magento's cron execution flow.
Ongoing coverage of React2Shell