p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

magento/project-community-edition 2.0.1: bekannte Sicherheitslücken · Seite 3

Bekannte Sicherheitslücken für magento/project-community-edition 2.0.1: 160. Vergleichen Sie die unten genannten Korrekturen mit Ihrer installierten Version.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 160

  1. CVE-2025-24410

    Hoch · CVSS 8.7EPSS 0,7%Keine Korrektur veröffentlicht

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  2. CVE-2025-24408

    Mittel · CVSS 6.5EPSS 0,96%Keine Korrektur veröffentlicht

    Adobe Commerce | Information Exposure (CWE-200)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. CVE-2025-24435

    Mittel · CVSS 4.3EPSS 0,53%Keine Korrektur veröffentlicht

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to modify limited fields. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  4. CVE-2024-39419

    Mittel · CVSS 4.3EPSS 0,43%Keine Korrektur veröffentlicht

    A user without ship permissions can ship the orders

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  5. CVE-2024-39403

    Hoch · CVSS 7.6EPSS 0,54%Keine Korrektur veröffentlicht

    Stored XSS through Webhook module public key configuration

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  6. CVE-2024-39418

    Mittel · CVSS 5.4EPSS 0,41%Keine Korrektur veröffentlicht

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  7. CVE-2024-39413

    Mittel · CVSS 4.3EPSS 0,44%Keine Korrektur veröffentlicht

    An unauthorized user can export the Invoiced Sales Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  8. CVE-2024-39399

    Hoch · CVSS 7.7EPSS 0,91%Keine Korrektur veröffentlicht

    [Paris] Path Traversal lead to local file read

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  9. CVE-2024-39417

    Mittel · CVSS 4.3EPSS 0,44%Keine Korrektur veröffentlicht

    An unauthorized user can export the Shipping Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  10. CVE-2024-39407

    Mittel · CVSS 4.3EPSS 0,43%Keine Korrektur veröffentlicht

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  11. CVE-2024-39398

    Hoch · CVSS 7.4EPSS 0,86%Keine Korrektur veröffentlicht

    OTP 2FA can be bruteforced

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  12. CVE-2024-39401

    Hoch · CVSS 8.4EPSS 1,67%Keine Korrektur veröffentlicht

    Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  13. CVE-2024-39411

    Mittel · CVSS 4.3EPSS 0,44%Keine Korrektur veröffentlicht

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  14. CVE-2024-39416

    Mittel · CVSS 4.3EPSS 0,42%Keine Korrektur veröffentlicht

    Unauthorized user can export Orders Sale Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  15. CVE-2024-39414

    Mittel · CVSS 4.3EPSS 0,44%Keine Korrektur veröffentlicht

    Being able to import/export tax rates without proper privileges

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  16. CVE-2024-39402

    Hoch · CVSS 8.4EPSS 1,67%Keine Korrektur veröffentlicht

    Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  17. CVE-2024-39400

    Hoch · CVSS 8.1EPSS 0,7%Keine Korrektur veröffentlicht

    DOM XSS through integrations can impact other admins

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  18. CVE-2024-39404

    Mittel · CVSS 4.3EPSS 0,46%Keine Korrektur veröffentlicht

    A user without Shop Policy Parameters section privilege can alter the shop policy parameters section

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  19. CVE-2024-39415

    Mittel · CVSS 4.3EPSS 0,44%Keine Korrektur veröffentlicht

    An unauthorized user can export the Tax Sales Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  20. CVE-2024-39405

    Mittel · CVSS 4.3EPSS 0,43%Keine Korrektur veröffentlicht

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →