p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in magento/community-edition · Seite 10

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für magento/community-edition: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 360

  1. CVE-2021-28556

    Mittel · CVSS 6.9EPSS 1,4%Korrektur verfügbar

    Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.7 aktualisieren
    • Auf 2.4.2-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  2. CVE-2021-21014

    Kritisch · CVSS 9.1EPSS 4,21%Korrektur verfügbar

    Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. CVE-2021-21016

    Kritisch · CVSS 9.1EPSS 4,85%Korrektur verfügbar

    Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  4. CVE-2021-21025

    Kritisch · CVSS 9.1EPSS 3,27%Korrektur verfügbar

    Magento Commerce XML Injection Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  5. CVE-2021-21018

    Kritisch · CVSS 9.1EPSS 3,99%Korrektur verfügbar

    Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  6. CVE-2021-21032

    Mittel · CVSS 5.6EPSS 1,56%Korrektur verfügbar

    Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  7. CVE-2021-21029

    Mittel · CVSS 4.8EPSS 84,64%Korrektur verfügbar

    Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  8. CVE-2021-21015

    Hoch · CVSS 8EPSS 2,93%Korrektur verfügbar

    Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  9. CVE-2021-21019

    Kritisch · CVSS 9.1EPSS 3,64%Korrektur verfügbar

    Magento Commerce XML Injection Could Lead To Remote Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  10. CVE-2021-21020

    Mittel · CVSS 5.3EPSS 2,41%Korrektur verfügbar

    Magento Commerce Improper Access Control Vulnerability

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  11. CVE-2021-21024

    Kritisch · CVSS 9.1EPSS 2,77%Korrektur verfügbar

    Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  12. CVE-2021-21026

    Mittel · CVSS 5.3EPSS 1,81%Korrektur verfügbar

    Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  13. CVE-2021-21023

    Mittel · CVSS 4.8EPSS 1,61%Korrektur verfügbar

    Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  14. CVE-2021-21022

    Mittel · CVSS 5.3EPSS 2,2%Korrektur verfügbar

    Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  15. CVE-2021-21030

    Hoch · CVSS 8.1EPSS 5,62%Korrektur verfügbar

    Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  16. CVE-2021-21027

    Mittel · CVSS 4.3EPSS 1,66%Korrektur verfügbar

    Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6-p1 aktualisieren
    • Auf 2.4.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  17. CVE-2021-21031

    Mittel · CVSS 5.6EPSS 1,67%Korrektur verfügbar

    Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1-p1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  18. CVE-2020-24404

    Niedrig · CVSS 2.7EPSS 1,87%Korrektur verfügbar

    Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  19. CVE-2020-24407

    Kritisch · CVSS 9.1EPSS 5,27%Korrektur verfügbar

    Arbitrary code execution via file import functionality

    Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

    magento/community-editionPHP
    • Auf 2.4.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  20. CVE-2020-24406

    Niedrig · CVSS 3.7EPSS 2,08%Korrektur verfügbar

    Document root path disclosure on Maintenance page

    When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.

    magento/community-edition magento/community-editionPHP
    • Auf 2.3.6 aktualisieren
    • Auf 2.4.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →