Magento CMS Email Remainder Functionality Remote Code Execution Vulnerability

Bugtraq ID:	98780
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 31 2017 12:00AM
Updated:	May 31 2017 12:00AM
Credit:	The vendor reported the issue.
Vulnerable:	Magento Enterprise Edition 2.1.6 Magento Enterprise Edition 2.1.2 Magento Enterprise Edition 2.0.6 Magento Enterprise Edition 2.0.5 Magento Enterprise Edition 2.0.4 Magento Enterprise Edition 2.0.3 Magento Enterprise Edition 2.0.2 Magento Enterprise Edition 2.0.1 Magento Community Edition 2.0.6 Magento Community Edition 2.0.5 Magento Community Edition 2.0.4 Magento Community Edition 2.0.3 Magento Community Edition 2.0.2 Magento Community Edition 2.1.6 Magento Community Edition 2.0.1
Not Vulnerable:	Magento Enterprise Edition 2.1.7 Magento Enterprise Edition 2.0.14 Magento Community Edition 2.1.7 Magento Community Edition 2.0.14

Magento CMS Email Remainder Functionality Remote Code Execution Vulnerability

Magento CMS is prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts may cause a denial-of-service condition.

The following products are affected:

Versions prior to Magento Community Edition 2.0.14 and 2.1.7
Versions prior to Magento Enterprise Edition 2.0.14 and 2.1.7

Magento CMS Email Remainder Functionality Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Magento CMS Email Remainder Functionality Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Magento CMS Email Remainder Functionality Remote Code Execution Vulnerability

References:

• Magento Homepage (Magento)
  
• Magento 2.0.14 and 2.1.7 Security Update (Magento)