Vulnerability advisory

GHSA-8j7c-682x-r9f2

Magento RCE,XSS and other vulnerabilities

Published May 15, 2024Updated Nov 29, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.16	`2.1.16`Advisories →
Also listed as affected (19) `2.1.0` `2.1.0-rc1` `2.1.0-rc2` `2.1.0-rc3` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2` to before 2.2.7	`2.2.7`Advisories →
Also listed as affected (7) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6`

Description

Magento Commerce and Open Source 2.3.0, 2.2.7 and 2.1.16 contain multiple security enhancements that help close Remote Code Execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

References

Webgithub.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/2018-11-28.yaml ↗
Packagegithub.com/magento/magento2 ↗
Webweb.archive.org/web/20210802095950/https://magento.com/security/patches/magento-2.2.7-and-2.1.16-security-update ↗