.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/community-edition 2.2.9 vulnerabilities

360 advisories known · magento/community-edition@2.2.9 · 221 affect this release · Dependencies not checked · showing 60 more

SEVERITYADVISORYPUBLISHED

Does not affect 2.2.9

SEVERITYADVISORYPUBLISHED

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-3mxq-v9rw-m6x9CVE-2019-7944Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-c45w-p293-7cv6CVE-2019-7945Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Cross-site Scripting VulnerabilityGHSA-gg96-8w9x-7rx9CVE-2019-7921Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-ff7r-7rrm-wx6wCVE-2019-7882Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-7xqv-jgv6-x2h8CVE-2019-7881Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Open Source allows Uncontrolled Resource ConsumptionGHSA-7pfc-834q-h497CVE-2023-38251Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

MediumMagento Open Source allows XML InjectionGHSA-rpv2-g4pc-wp72CVE-2023-38207Affected >=2.4.4-p1 <2.4.4-p5, >=2.4.5-p1 <2.4.5-p4, >=2.4.6-p1 <2.4.6-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p5 Fixed in 2.4.5-p4 Fixed in 2.4.6-p2OSV source ↗3 years ago

MediumMagento Open Source allows Information ExposureGHSA-85m4-g9vq-xpxjCVE-2023-29287Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-qw5m-vmp3-f553CVE-2023-29290Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Improper Access ControlGHSA-4h7p-4vq8-g2ghCVE-2023-22250Affected >=2.4.4-p1 <2.4.4-p3, >=2.4.5-p1 <2.4.5-p2, ==2.4.4, ==2.4.5Fixed in 2.4.4-p3 Fixed in 2.4.5-p2OSV source ↗4 years ago

MediumMagento Open Source allows Improper Access ControlGHSA-5fxx-jwjm-x9hjCVE-2022-35689Affected >=2.4.3-p1 <=2.4.3-p3, >=2.4.4-p1 <2.4.4-p2, ==2.4.3, ==2.4.4, ==2.4.5Fixed in 2.4.4-p2OSV source ↗4 years ago

MediumMagento Open Source has Improper Access Control vulnerabilityGHSA-gm4m-9rm8-7rxjCVE-2022-35692Affected >=2.3.7-p1 <2.3.7-p4, >=2.4.3-p1 <2.4.3-p3, ==2.3.7, ==2.4.3, ==2.4.4Fixed in 2.3.7-p4 Fixed in 2.4.3-p3OSV source ↗4 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-9wjf-94h3-r4rhBIT-magento-2022-34259CVE-2022-34259Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

MediumMagento 2 Community Edition Information DisclosureGHSA-274w-2j5w-m2xjCVE-2019-7899Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Information DisclosureGHSA-vqxq-3wqv-r9xpCVE-2019-7898Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition IDOR VulnerabilityGHSA-c33v-23rx-7qqcCVE-2019-7864Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Cryptographic FlawGHSA-2w26-gmqm-mc5pCVE-2019-7855Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Path DisclosureGHSA-xcgp-c6hp-cj4rCVE-2019-7852Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Open Source allows Uncontrolled Resource ConsumptionGHSA-c9h9-h5gf-885rCVE-2024-20716Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

MediumMagento Open Source has Improper Input Validation VulnerabilityGHSA-9mx6-4gg4-85xjCVE-2023-26367Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-4588-7x48-jrgjCVE-2023-29292Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-5f79-vhr4-vw2rCVE-2023-29291Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Insecure Direct Object Reference (IDOR) vulnerabilityGHSA-7g5j-q8qj-8984CVE-2019-7925Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Information DisclosureGHSA-h522-94xp-2xr6CVE-2019-7929Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Open Source allows Cross-Site Scripting (XSS)GHSA-fxcr-gvcw-hmqmCVE-2023-22249Affected >=2.4.4-p1 <=2.4.4-p2, ==2.4.4, 2.4.5 - 2.4.5-p1OSV source ↗3 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-86pc-6mm8-542rCVE-2019-8148Affected >=2.3.0 <2.3.2-p2Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-5c4g-p858-498xCVE-2019-7935Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-77mv-p94f-qcq4CVE-2019-7934Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-94fc-rxhv-vvf8CVE-2019-7937Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-mf6x-7766-5cg8CVE-2019-7936Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-mgfr-44wv-hqv6CVE-2019-7938Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-525g-rvh4-v5c9CVE-2019-7926Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-r68f-45jg-64m6CVE-2019-7927Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-jxp3-mmw7-8285CVE-2019-7897Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Cross-site Scripting in the admin panelGHSA-mgfv-4whf-c574CVE-2019-7908Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Cross-site Scripting VulnerabilityGHSA-pw2f-m22m-p75cCVE-2019-7909Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-ccjm-rgm5-rjjhCVE-2019-7880Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Cross-site Scripting VulnerabilityGHSA-rj8f-g5gm-jw5cCVE-2019-7887Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Stored Cross-site Scripting vulnerability in the admin panelGHSA-9f4p-3jgf-98f5CVE-2019-7869Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Cross-site Scripting in the admin panelGHSA-g4jh-vxqm-6fffCVE-2019-7868Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Stored cross-site scripting in admin panelGHSA-p8gw-x2p7-vc73CVE-2019-7863Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Cross-site Scripting VulnerabilityGHSA-qmwh-rh2g-3682CVE-2019-7875Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-3ccx-7588-r6c6CVE-2019-7866Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-m3v2-r236-5xgqCVE-2019-7862Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-vx2g-f45p-j674CVE-2019-7867Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-mjgf-xmrr-6gvxCVE-2019-7853Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-8w5f-8992-g86jCVE-2024-39413Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-cjm6-8mw8-2f8cCVE-2024-39407Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-5g9f-7gqc-8hj4CVE-2024-39405Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-qrh3-vxjg-h9h6CVE-2024-39404Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Open Source allows Cross-Site Request Forgery (CSRF)GHSA-hqgj-4396-hmxvCVE-2024-20718Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

MediumMagento Open Source has Business Logic Errors VulnerabilityGHSA-28vp-39rf-3q2jCVE-2023-29294Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-354h-fpmq-68v7CVE-2023-29295Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-3qr4-w96f-672vCVE-2023-29296Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-f989-3fp9-q3r2CVE-2023-29288Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-2wm7-mmgc-qxr3CVE-2023-22251Affected >=2.4.4-p1 <2.4.4-p3, >=2.4.5-p1 <2.4.5-p2, ==2.4.4, ==2.4.5Fixed in 2.4.4-p3 Fixed in 2.4.5-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition Cross-site Scripting VulnerabilityGHSA-8578-mmf4-f327CVE-2019-7873Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Cross-Site Request Forgery (CSRF)GHSA-f6ww-vqw2-xp3vCVE-2019-7857Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

LowMagento Information Disclosure vulnerabilityGHSA-w942-fw92-mqm2BIT-magento-2021-28566CVE-2021-28566Affected >=2.3.0 <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

LowMagento Open Source affected by Improper Input ValidationGHSA-66c9-xrwj-9xv6CVE-2023-29293Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago