p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in magento/community-edition · Seite 6

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für magento/community-edition: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 360

  1. GHSA-prpf-cj87-hwvr

    Nicht bewertetKorrektur verfügbar

    Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities

    Magento Commerce 1.14.3.9 and Open Source 1.9.3.9 bring essential security enhancements with Patch SUPEE-10752. These updates address various vulnerabilities, including authenticated Admin user remote code execution (RCE), cross-site request forgery (CSRF), and more. Key Security Improvements: - APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML - APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only) - APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module) - APPSEC-2029: PHP Object Injection and Remote Code Execution

    magento/community-editionPHP
    • Auf 1.9.3.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2024-20758

    Kritisch · CVSS 9EPSS 1,42%Korrektur verfügbar

    Adobe Commerce | Improper Input Validation (CWE-20)

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p8 aktualisieren
    • Auf 2.4.5-p7 aktualisieren
    • Auf 2.4.6-p5 aktualisieren
    • Auf 2.4.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. CVE-2024-20759

    Hoch · CVSS 8.1EPSS 1,03%Korrektur verfügbar

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p8 aktualisieren
    • Auf 2.4.5-p7 aktualisieren
    • Auf 2.4.6-p5 aktualisieren
    • Auf 2.4.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  4. CVE-2024-20716

    Mittel · CVSS 4.9EPSS 0,87%Korrektur verfügbar

    Force high-usage of resources by generating unlimited coupons: Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust system resources, causing the application to slow down or crash. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p7 aktualisieren
    • Auf 2.4.5-p6 aktualisieren
    • Auf 2.4.6-p4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  5. CVE-2024-20718

    Mittel · CVSS 4.3EPSS 0,76%Korrektur verfügbar

    [Spain] CSRF to delete Requisition Lists at Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p7 aktualisieren
    • Auf 2.4.5-p6 aktualisieren
    • Auf 2.4.6-p4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  6. CVE-2024-20719

    Kritisch · CVSS 9.1EPSS 1,31%Korrektur verfügbar

    [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p7 aktualisieren
    • Auf 2.4.5-p6 aktualisieren
    • Auf 2.4.6-p4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  7. CVE-2024-20720

    Kritisch · CVSS 9.1EPSS 3,69%Korrektur verfügbar

    Command injection in data collector backup due to insufficient patching of CVE-2023-38208

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p7 aktualisieren
    • Auf 2.4.5-p6 aktualisieren
    • Auf 2.4.6-p4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  8. CVE-2023-38251

    Mittel · CVSS 5.3EPSS 0,76%Korrektur verfügbar

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  9. CVE-2023-38219

    Hoch · CVSS 8.7EPSS 0,75%Korrektur verfügbar

    Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  10. CVE-2023-38220

    Hoch · CVSS 7.5EPSS 0,8%Korrektur verfügbar

    Full page cache enumeration via cookie X-Magento-Vary

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  11. CVE-2023-26367

    Mittel · CVSS 4.9EPSS 0,8%Korrektur verfügbar

    Error based file extraction via PHP filter chains during product bulk import logic

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  12. CVE-2023-26366

    Mittel · CVSS 6.8EPSS 0,86%Korrektur verfügbar

    Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  13. CVE-2023-38218

    Hoch · CVSS 8.8EPSS 0,88%Korrektur verfügbar

    Incorrect Authorization - Customer account takeover

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  14. CVE-2023-38250

    Hoch · CVSS 8EPSS 0,83%Korrektur verfügbar

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  15. CVE-2023-38249

    Hoch · CVSS 8EPSS 0,83%Korrektur verfügbar

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  16. CVE-2023-38221

    Hoch · CVSS 8EPSS 0,83%Korrektur verfügbar

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.4.4-p6 aktualisieren
    • Auf 2.4.5-p5 aktualisieren
    • Auf 2.4.6-p3 aktualisieren
    • Auf 2.4.7-beta2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  17. CVE-2022-24093

    Kritisch · CVSS 9.1EPSS 1,51%Korrektur verfügbar

    Adobe Commerce post-auth improper input validation leads to remote code execution

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.3.7-p3 aktualisieren
    • Auf 2.4.3-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  18. CVE-2021-36036

    Hoch · CVSS 7.2EPSS 2,12%Korrektur verfügbar

    Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.3.7-p1 aktualisieren
    • Auf 2.4.2-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  19. CVE-2021-36021

    Hoch · CVSS 7.2EPSS 2,01%Korrektur verfügbar

    Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.3.7-p1 aktualisieren
    • Auf 2.4.2-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  20. CVE-2021-36023

    Kritisch · CVSS 9.1EPSS 2,37%Korrektur verfügbar

    Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Auf 2.3.7-p1 aktualisieren
    • Auf 2.4.2-p2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →