CVE-2021-28583: Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats

May 24, 2022 (updated February 10, 2025)

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.

References

github.com/advisories/GHSA-7gh6-f4jh-3crq
github.com/magento/magento2
github.com/magento/magento2/commit/1bd5cb8c065e44779526c0b044ce19b884707695
helpx.adobe.com/security/products/magento/apsb21-30.html
nvd.nist.gov/vuln/detail/CVE-2021-28583

Code Behaviors & Features

Detect and mitigate CVE-2021-28583 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →