Vulnerability advisory

GHSA-5gmh-85x8-5cx7

Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

Published May 15, 2024Updated Nov 29, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.14	`2.1.14`Advisories →
Also listed as affected (17) `2.1.0` `2.1.0-rc1` `2.1.0-rc2` `2.1.0-rc3` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2` to before 2.2.5	`2.2.5`Advisories →
Also listed as affected (5) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4`

Description

Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

References

Webgithub.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/2018-06-27.yaml ↗
Packagegithub.com/magento/magento2 ↗
Webweb.archive.org/web/20210802091126/https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update ↗