p PatchFirst

PatchFirst · Latest vulnerabilities

magento/community-edition vulnerabilities · Page 5

Vulnerabilities published for magento/community-edition in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 360

  1. CVE-2024-39412

    Medium · CVSS 4.3EPSS 0.43%Fix available

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and perform a minor integrity change. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p10
    • Update to 2.4.5-p9
    • Update to 2.4.6-p7
    • Update to 2.4.7-p2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2024-39402

    High · CVSS 8.4EPSS 1.67%Fix available

    Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p10
    • Update to 2.4.5-p9
    • Update to 2.4.6-p7
    • Update to 2.4.7-p2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2024-39406

    Medium · CVSS 6.8EPSS 0.87%Fix available

    Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p10
    • Update to 2.4.5-p9
    • Update to 2.4.6-p7
    • Update to 2.4.7-p2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2024-39400

    High · CVSS 8.1EPSS 0.7%Fix available

    DOM XSS through integrations can impact other admins

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p10
    • Update to 2.4.5-p9
    • Update to 2.4.6-p7
    • Update to 2.4.7-p2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2024-39404

    Medium · CVSS 4.3EPSS 0.46%Fix available

    A user without Shop Policy Parameters section privilege can alter the shop policy parameters section

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p10
    • Update to 2.4.5-p9
    • Update to 2.4.6-p7
    • Update to 2.4.7-p2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2024-39415

    Medium · CVSS 4.3EPSS 0.44%Fix available

    An unauthorized user can export the Tax Sales Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p10
    • Update to 2.4.5-p9
    • Update to 2.4.6-p7
    • Update to 2.4.7-p2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2024-39405

    Medium · CVSS 4.3EPSS 0.43%Fix available

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p10
    • Update to 2.4.5-p9
    • Update to 2.4.6-p7
    • Update to 2.4.7-p2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2024-34106

    Medium · CVSS 5.3EPSS 0.85%Fix available

    Insecure Direct Object Reference - An attacker can able to erase the victim quote details

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p9
    • Update to 2.4.5-p8
    • Update to 2.4.6-p6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2024-34103

    High · CVSS 8.1EPSS 0.91%Fix available

    Customer account takeover via web API call & subsequent password reset

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p9
    • Update to 2.4.5-p8
    • Update to 2.4.6-p6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2024-34111

    Medium · CVSS 6.5EPSS 1.27%Fix available

    SSRF in service connector

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p9
    • Update to 2.4.5-p8
    • Update to 2.4.6-p6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2024-34107

    Medium · CVSS 5.3EPSS 1.13%Fix available

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p9
    • Update to 2.4.5-p8
    • Update to 2.4.6-p6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2024-34105

    Medium · CVSS 4.8EPSS 0.67%Fix available

    Stored Cross Site Scripting in Order Comment

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p9
    • Update to 2.4.5-p8
    • Update to 2.4.6-p6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2024-34104

    High · CVSS 8.2EPSS 0.79%Fix available

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p9
    • Update to 2.4.5-p8
    • Update to 2.4.6-p6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2024-34102

    Critical · CVSS 9.8EPSS 99.99%In KEVPublic exploitFix available

    XXE can expose crypt key and other secrets granting full admin access

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Update to 2.4.4-p9
    • Update to 2.4.5-p8
    • Update to 2.4.6-p6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. GHSA-5gmh-85x8-5cx7

    Not ratedFix available

    Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

    Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Update to 2.1.14
    • Update to 2.2.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. GHSA-cv25-3pxr-4q7x

    Not ratedFix available

    Magento Open Source Security Advisory: Patch SUPEE-10975

    Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated: - PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication - MAG-23: M1 Credit Card Storage Capability - PRODSECBUG-2149: Authenticated RCE using customer import - PRODSECBUG-2159: API Based RCE Vulnerability - PRODSECBUG-2156: RCE Via Unauthorized Upload - PRODSECBUG-2155: Authenticated RCE using dataflow - PRODSECBUG-2053:

    magento/community-editionPHP
    • Update to 1.14.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. GHSA-26hq-7286-mg8f

    Not ratedFix available

    Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

    Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well. Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to: - use sendmail as the mail transport agent - have specific, non-default configuration settings as described [here](https://magento.com/security/patches/supee-9652#:~:text=settings%20as%20described-,here,-.).

    magento/community-editionPHP
    • Update to 1.14.3.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. GHSA-6wm4-3rjj-c8xx

    Not ratedFix available

    Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities

    SUPEE-10975, Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 contain multiple security enhancements that help close remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.

    magento/community-editionPHP
    • Update to 1.9.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →