.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/community-edition 2.2.9 vulnerabilities

360 advisories known · magento/community-edition@2.2.9 · 221 affect this release · Dependencies not checked · showing 100 more

SEVERITYADVISORYPUBLISHED

Affects 2.2.9

SEVERITYADVISORYPUBLISHED

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-7472-vw39-g2j3CVE-2024-39412Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Access Control Leads to Privilege escalationGHSA-74w7-cr4v-wf2vCVE-2024-39419Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization Leading to Security feature bypassGHSA-gj93-84g5-mcjqCVE-2024-39415Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to security feature bypassGHSA-qm77-mqf3-fmhqCVE-2024-39411Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-rf4q-m23c-7q8rCVE-2024-39409Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Access Control Leads to Privilege escalationGHSA-x6f9-hv9r-fgq4CVE-2024-39414Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento cross-site request forgery (CSRF) vulnerability via the GraphQL APIGHSA-h4xc-577p-hgj9BIT-magento-2021-21027CVE-2021-21027Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento incorrect permissions vulnerability in the Inventory moduleGHSA-p7m7-j8jv-393qBIT-magento-2020-24405CVE-2020-24405Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento observable timing discrepancy vulnerabilityGHSA-xgp9-j48h-jjf9BIT-magento-2020-9690CVE-2020-9690Affected <2.3.5-p2Fixed in 2.3.5-p2OSV source ↗4 years ago

LowMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-6w27-c66f-gvhqCVE-2025-24430Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

LowMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-7jmr-43qj-pw47CVE-2025-24432Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

LowMagento information disclosure vulnerabilityGHSA-mr8q-7f5j-wc79BIT-magento-2020-24406CVE-2020-24406Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

LowMagento Improper Access Control vulnerabilityGHSA-656q-fx2w-8ccvCVE-2025-24429Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

LowMagento Authenticated Security feature bypassGHSA-85jx-x9r4-45m2CVE-2025-49549Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

LowMagento does not properly protect credentialsGHSA-2r94-wm5v-4prxCVE-2025-27192Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

LowMagento Open Source Information Exposure vulnerabilityGHSA-4f89-5cwm-rm5gBIT-magento-2024-45134CVE-2024-45134Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento Open Source Improper Access Control vulnerabilityGHSA-8pxg-gcp4-57wwBIT-magento-2024-45135CVE-2024-45135Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento Open Source Information Exposure vulnerabilityGHSA-j3mh-wx5f-2vhgBIT-magento-2024-45133CVE-2024-45133Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento Open Source Improper Access Control vulnerabilityGHSA-w7rg-7wq2-pjrwBIT-magento-2024-45149CVE-2024-45149Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento incorrect user permissions vulnerability within the Inventory componentGHSA-39rw-4m66-82gfBIT-magento-2020-24403CVE-2020-24403Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

LowMagento 2 Community Edition vulnerable to Improper AuthorizationGHSA-rwf7-652f-76mvBIT-magento-2020-24404CVE-2020-24404Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

Does not affect 2.2.9

SEVERITYADVISORYPUBLISHED

CriticalMagento Open Source allows Stored Cross-Site Scripting (Stored XSS)GHSA-4vj2-426r-jm3gCVE-2022-35698Affected >=2.4.3-p1 <=2.4.3-p3, ==2.4.3, 2.4.4 - 2.4.4-p1, ==2.4.5OSV source ↗4 years ago

CriticalMagento 2 Community Edition SQLi VulnerabilityGHSA-4j6w-9rf8-hg7rCVE-2019-7139Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

CriticalMagento 2 Community Edition RCE VulnerabilityGHSA-vpg9-gq7j-mxqgCVE-2019-8144Affected >=2.3 <2.3.2-p1Fixed in 2.3.2-p1OSV source ↗4 years ago

CriticalMagento improper input validation vulnerabilityGHSA-f8fv-f786-9933BIT-magento-2022-24086CVE-2022-24086Affected >=2.3.3-p1 <2.3.7-p3, >=2.4.0 <2.4.3-p2Fixed in 2.3.7-p3 Fixed in 2.4.3-p2OSV source ↗5 years ago

CriticalMagento RCE,XSS and other vulnerabilitiesGHSA-8j7c-682x-r9f2Affected >=2.1 <2.1.16, >=2.2 <2.2.7, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.16 Fixed in 2.2.7OSV source ↗2 years ago

CriticalMagento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilitiesGHSA-5gmh-85x8-5cx7Affected >=2.1 <2.1.14, >=2.2 <2.2.5, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.14 Fixed in 2.2.5OSV source ↗2 years ago

CriticalMagento Open Source Security Advisory: Patch SUPEE-10975GHSA-cv25-3pxr-4q7xAffected >=1.9.0.0 <1.14.4.0Fixed in 1.14.4.0OSV source ↗2 years ago

CriticalMagento Patch SUPEE-9652 - Remote Code Execution using mail vulnerabilityGHSA-26hq-7286-mg8fAffected >=1.9.0.0 <1.14.3.2Fixed in 1.14.3.2OSV source ↗2 years ago

CriticalMagento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilitiesGHSA-6wm4-3rjj-c8xxAffected >=1.5.0.0 <1.9.4.0Fixed in 1.9.4.0OSV source ↗2 years ago

CriticalMagento Patch SUPEE-10752 - Multiple security enhancements vulnerabilitiesGHSA-prpf-cj87-hwvrAffected <1.9.3.9Fixed in 1.9.3.9OSV source ↗2 years ago

CriticalMagento Open Source allows Cross-Site Scripting (XSS)GHSA-264g-f7v8-q5qqCVE-2024-20719Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

CriticalMagento Open Source allows OS Command InjectionGHSA-525f-pvj5-vqmqCVE-2024-20720Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-mxc9-g6m4-2v35CVE-2023-38208Affected >=2.4.4-p1 <2.4.4-p5, >=2.4.5-p1 <2.4.5-p4, >=2.4.6-p1 <2.4.6-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p5 Fixed in 2.4.5-p4 Fixed in 2.4.6-p2OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-gfmm-ww6f-5mm5CVE-2023-29297Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Input ValidationGHSA-wh4m-6rh3-p4rqBIT-magento-2024-20758CVE-2024-20758Affected >=2.4.4-p1 <2.4.4-p8, >=2.4.5-p1 <2.4.5-p7, >=2.4.6-p1 <2.4.6-p5, >=2.4.7-beta1 <2.4.7, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p8 Fixed in 2.4.5-p7 Fixed in 2.4.6-p5 Fixed in 2.4.7OSV source ↗3 years ago

HighMagento Open Source allows Incorrect AuthorizationGHSA-rpc7-gf58-v3x2CVE-2023-38218Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Improper Access Control vulnerabilityGHSA-x95x-f4g9-mm85BIT-magento-2022-34255CVE-2022-34255Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-mp9r-rh95-f8f8CVE-2019-7885Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-6qh6-v99h-vh4cCVE-2019-7876Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Unsafe File UploadGHSA-v527-6h5r-cfg8CVE-2019-7871Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition CSRF VulnerabilityGHSA-wmrg-w9vg-7jqxCVE-2019-7865Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento Open Source allows Cross-Site Scripting (XSS)GHSA-3j7w-jp46-9752CVE-2023-38219Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Path Traversal vulnerabilityGHSA-fx9g-g9q6-x3jxBIT-magento-2022-34254CVE-2022-34254Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-2ff6-837j-hg5xCVE-2024-39402Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-8frp-pxq2-3gpqCVE-2024-39401Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento DOM-based Cross-Site Scripting (XSS) vulnerabilityGHSA-52fg-wjxm-pp44CVE-2024-39400Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento Open Source allows Cross-Site Scripting (XSS)GHSA-59vf-hjxc-f9c5BIT-magento-2024-20759CVE-2024-20759Affected >=2.4.4-p1 <2.4.4-p8, >=2.4.5-p1 <2.4.5-p7, >=2.4.6-p1 <2.4.6-p5, >=2.4.7-beta1 <2.4.7, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p8 Fixed in 2.4.5-p7 Fixed in 2.4.6-p5 Fixed in 2.4.7OSV source ↗3 years ago

HighMagento Open Source allows SQL Injection GHSA-h3g9-cwr6-hphxCVE-2023-38250Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Open Source allows SQL InjectionGHSA-rq36-9f5f-2gw7CVE-2023-38249Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Open Source allows SQL Injection GHSA-ggr8-3hwx-4f2mCVE-2023-38221Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Path Traversal vulnerabilityGHSA-7r99-8wqp-h7pcCVE-2024-39399Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) vulnerability GHSA-mmp7-8cg4-9wrgCVE-2024-39403Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento Open Source allows Improper AuthorizationGHSA-grc6-r6f8-xj7cCVE-2023-38220Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Open Source affected by Improper Input ValidationGHSA-5jfg-phx7-7fxgCVE-2023-22248Affected >=2.4.4-p1 <2.4.5-p4, ==2.4.4, ==2.4.6Fixed in 2.4.5-p3 Fixed in 2.4.5-p4OSV source ↗3 years ago

HighMagento Open Source allows XML InjectionGHSA-2444-8gj8-6fmxCVE-2023-22247Affected >=2.4.4-p1 <2.4.4-p3, >=2.4.5-p1 <2.4.5-p2, ==2.4.4, ==2.4.5Fixed in 2.4.4-p3 Fixed in 2.4.5-p2OSV source ↗4 years ago

HighMagento Improper Authorization vulnerabilityGHSA-r7mm-grf3-5fjvBIT-magento-2022-34256CVE-2022-34256Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento 2 Community Edition Access Control BypassGHSA-2fhr-f6q6-c4p2CVE-2019-7950Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Information LeakGHSA-5j25-5hjr-w7m2CVE-2019-7951Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition DoS vulnerabilityGHSA-hrg3-4q56-p2q5CVE-2019-7928Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition DoS vulnerabilityGHSA-prw8-gqwp-f7fhCVE-2019-7915Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Cryptographic FlawGHSA-c2gg-rrhc-fvvgCVE-2019-7886Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Cryptographic FlawGHSA-7h8v-f2g9-39fxCVE-2019-7858Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Weak PRNGGHSA-8v9h-m7pj-hx7cCVE-2019-7860Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition IDOR VulnerabilityGHSA-hpxv-vpfv-7jc9CVE-2019-7854Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Path Traversal VulnerabilityGHSA-hqhf-8jgc-h5hxCVE-2019-7859Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Unsafe File UploadGHSA-j837-vm6w-6qcvCVE-2019-7861Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Session Fixation CheckGHSA-v797-hfv8-v2xmCVE-2019-7849Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighUnauthenticated crypto and weak IV in Magento\Framework\EncryptionGHSA-h7qw-mxrm-c6h2CVE-2016-6485Affected >=2.0 <2.2.6, 2.0.0-rc - 2.0.0-rc2Fixed in 2.2.6OSV source ↗7 years ago

HighMagento does not properly restrict excessive authentication attemptsGHSA-q628-54wg-4r5qCVE-2024-39398Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento 2 Community Edition IDOR VulnerabilityGHSA-3pgc-7jf3-5x5gCVE-2019-7890Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento Open Source affected by Improper Input ValidationGHSA-5xmp-7wg5-x68qCVE-2022-24093Affected >=2.3.7-p1 <2.3.7-p3, >=2.4.3-p1 <2.4.3-p2, ==2.3.7, ==2.4.3Fixed in 2.3.7-p3 Fixed in 2.4.3-p2OSV source ↗3 years ago

HighMagento 2 Community Unrestricted File UploadGHSA-3h69-4frw-g2jmCVE-2019-7930Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-969v-mwp3-4mr3CVE-2019-7932Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCEGHSA-vvf9-fxhv-4rgjCVE-2019-7942Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Server-Side Request Forgery vulnerabilityGHSA-33cj-w75f-49m2CVE-2019-7911Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento Filter extension bypass via crafted store configuration keysGHSA-f8h9-7rpq-7qccCVE-2019-7912Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition SSRF vulnerabilityGHSA-hppc-rpfp-r8qwCVE-2019-7913Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition SSRF vulnerabilityGHSA-hvcp-jvx5-4pmpCVE-2019-7923Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-2x55-mg9r-24f7CVE-2019-7896Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-jhvh-mjfg-5m99CVE-2019-7903Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-mw5w-cf76-73m8CVE-2019-7895Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE Vulnerability via SSRFGHSA-w3r8-fxv5-58ppCVE-2019-7892Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-8jxc-5f94-22vhCVE-2023-26366Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect Authorization GHSA-3vg2-v639-6ch9CVE-2023-38209Affected >=2.4.4-p1 <2.4.4-p5, >=2.4.5-p1 <2.4.5-p4, >=2.4.6-p1 <2.4.6-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p5 Fixed in 2.4.5-p4 Fixed in 2.4.6-p2OSV source ↗3 years ago

MediumMagento Open Source allows XML InjectionGHSA-wh42-8r2w-873xCVE-2023-29289Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento 2 Community Edition CSRF vulnerabilityGHSA-w392-68rg-pgg4CVE-2019-7947Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Insufficient Access ControlsGHSA-5hcx-vg88-hgpmCVE-2019-7904Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Injection VulnerabilityGHSA-hxmp-jcqj-83hmCVE-2019-7889Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Information DisclosureGHSA-9pgc-rvp9-rqv3CVE-2019-7888Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-8v75-8jj8-77gfCVE-2019-7874Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Insufficient authorization check when adding users to company accountsGHSA-pfxv-66r9-4gqwCVE-2019-7872Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition CSRF vulnerabilityGHSA-mhvf-j94g-3qp7CVE-2019-7851Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Cross-Site Request Forgery (CSRF)GHSA-w3mq-67mw-3p9fCVE-2018-5301Affected <2.0.10, >=2.1.0 <2.1.2Fixed in 2.0.10 Fixed in 2.1.2OSV source ↗4 years ago

MediumMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-rg7p-wmgj-f374BIT-magento-2022-34257CVE-2022-34257Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

MediumMagento Reflected cross-site scripting on customer cart pageGHSA-r728-jwf5-f5r5CVE-2019-7939Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-v5m6-2m78-4vr2CVE-2019-7877Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Cross-Site Scripting (XSS) vulnerabilityGHSA-mcfc-67vm-j568Affected >=2.1 <2.1.15, >=2.2 <2.2.6, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.15 Fixed in 2.2.6OSV source ↗2 years ago

MediumMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-5m55-g8pv-x8wwBIT-magento-2022-34258CVE-2022-34258Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-gvgf-pvh5-vjh4CVE-2024-39418Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago