p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in magento/community-edition · Seite 5

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für magento/community-edition: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 360

  1. CVE-2024-39412

    Mittel · CVSS 4.3EPSS 0,43%Korrektur verfügbar

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and perform a minor integrity change. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p10 aktualisieren
    • Auf 2.4.5-p9 aktualisieren
    • Auf 2.4.6-p7 aktualisieren
    • Auf 2.4.7-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  2. CVE-2024-39402

    Hoch · CVSS 8.4EPSS 1,67%Korrektur verfügbar

    Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p10 aktualisieren
    • Auf 2.4.5-p9 aktualisieren
    • Auf 2.4.6-p7 aktualisieren
    • Auf 2.4.7-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. CVE-2024-39406

    Mittel · CVSS 6.8EPSS 0,87%Korrektur verfügbar

    Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p10 aktualisieren
    • Auf 2.4.5-p9 aktualisieren
    • Auf 2.4.6-p7 aktualisieren
    • Auf 2.4.7-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  4. CVE-2024-39400

    Hoch · CVSS 8.1EPSS 0,7%Korrektur verfügbar

    DOM XSS through integrations can impact other admins

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p10 aktualisieren
    • Auf 2.4.5-p9 aktualisieren
    • Auf 2.4.6-p7 aktualisieren
    • Auf 2.4.7-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  5. CVE-2024-39404

    Mittel · CVSS 4.3EPSS 0,46%Korrektur verfügbar

    A user without Shop Policy Parameters section privilege can alter the shop policy parameters section

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p10 aktualisieren
    • Auf 2.4.5-p9 aktualisieren
    • Auf 2.4.6-p7 aktualisieren
    • Auf 2.4.7-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  6. CVE-2024-39415

    Mittel · CVSS 4.3EPSS 0,44%Korrektur verfügbar

    An unauthorized user can export the Tax Sales Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p10 aktualisieren
    • Auf 2.4.5-p9 aktualisieren
    • Auf 2.4.6-p7 aktualisieren
    • Auf 2.4.7-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  7. CVE-2024-39405

    Mittel · CVSS 4.3EPSS 0,43%Korrektur verfügbar

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p10 aktualisieren
    • Auf 2.4.5-p9 aktualisieren
    • Auf 2.4.6-p7 aktualisieren
    • Auf 2.4.7-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  8. CVE-2024-34106

    Mittel · CVSS 5.3EPSS 0,85%Korrektur verfügbar

    Insecure Direct Object Reference - An attacker can able to erase the victim quote details

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p9 aktualisieren
    • Auf 2.4.5-p8 aktualisieren
    • Auf 2.4.6-p6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  9. CVE-2024-34103

    Hoch · CVSS 8.1EPSS 0,91%Korrektur verfügbar

    Customer account takeover via web API call & subsequent password reset

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p9 aktualisieren
    • Auf 2.4.5-p8 aktualisieren
    • Auf 2.4.6-p6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  10. CVE-2024-34111

    Mittel · CVSS 6.5EPSS 1,27%Korrektur verfügbar

    SSRF in service connector

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p9 aktualisieren
    • Auf 2.4.5-p8 aktualisieren
    • Auf 2.4.6-p6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  11. CVE-2024-34107

    Mittel · CVSS 5.3EPSS 1,13%Korrektur verfügbar

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p9 aktualisieren
    • Auf 2.4.5-p8 aktualisieren
    • Auf 2.4.6-p6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  12. CVE-2024-34105

    Mittel · CVSS 4.8EPSS 0,67%Korrektur verfügbar

    Stored Cross Site Scripting in Order Comment

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p9 aktualisieren
    • Auf 2.4.5-p8 aktualisieren
    • Auf 2.4.6-p6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  13. CVE-2024-34104

    Hoch · CVSS 8.2EPSS 0,79%Korrektur verfügbar

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p9 aktualisieren
    • Auf 2.4.5-p8 aktualisieren
    • Auf 2.4.6-p6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  14. CVE-2024-34102

    Kritisch · CVSS 9.8EPSS 99,99%Im KEV-KatalogÖffentlicher ExploitKorrektur verfügbar

    XXE can expose crypt key and other secrets granting full admin access

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p9 aktualisieren
    • Auf 2.4.5-p8 aktualisieren
    • Auf 2.4.6-p6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. GHSA-8j7c-682x-r9f2

    Nicht bewertetKorrektur verfügbar

    Magento RCE,XSS and other vulnerabilities

    Magento Commerce and Open Source 2.3.0, 2.2.7 and 2.1.16 contain multiple security enhancements that help close Remote Code Execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Auf 2.1.16 aktualisieren
    • Auf 2.2.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. GHSA-5gmh-85x8-5cx7

    Nicht bewertetKorrektur verfügbar

    Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

    Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Auf 2.1.14 aktualisieren
    • Auf 2.2.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. GHSA-cv25-3pxr-4q7x

    Nicht bewertetKorrektur verfügbar

    Magento Open Source Security Advisory: Patch SUPEE-10975

    Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated: - PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication - MAG-23: M1 Credit Card Storage Capability - PRODSECBUG-2149: Authenticated RCE using customer import - PRODSECBUG-2159: API Based RCE Vulnerability - PRODSECBUG-2156: RCE Via Unauthorized Upload - PRODSECBUG-2155: Authenticated RCE using dataflow - PRODSECBUG-2053:

    magento/community-editionPHP
    • Auf 1.14.4.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. GHSA-26hq-7286-mg8f

    Nicht bewertetKorrektur verfügbar

    Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

    Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well. Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to: - use sendmail as the mail transport agent - have specific, non-default configuration settings as described [here](https://magento.com/security/patches/supee-9652#:~:text=settings%20as%20described-,here,-.).

    magento/community-editionPHP
    • Auf 1.14.3.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. GHSA-6wm4-3rjj-c8xx

    Nicht bewertetKorrektur verfügbar

    Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities

    SUPEE-10975, Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 contain multiple security enhancements that help close remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.

    magento/community-editionPHP
    • Auf 1.9.4.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →