Back to Database
Status published
High
CVE-2021-32759
Data Flow Sanitation Issue Fix
Vulnerability Description
OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32759
Credits & Attribution
No credits recorded in the NVD database.
References
More from OpenMage
View All →CVE-2025-64174
OpenMage is vulnerable to XSS in Admin Notifications
Medium
4.6
CVE-2025-27400
Magento vulnerable to stored XSS in theme config fields
Low
2.9
CVE-2024-41676
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Medium
4.1
CVE-2023-41879
Magento LTS's guest order "protect code" can be brute-forced too easily
High
7.5
CVE-2023-23617
OpenMage LTS has DoS vulnerability in MaliciousCode filter
Medium
4.9
Affected Vendor
OpenMage
View all reports →Affected Software
magento-lts
Vulnerable Versions:
< 19.4.15, >= 20, < 20.0.13
Timeline
Official Publish:
August 27th, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H