Vulnerability advisory

GHSA-mcfc-67vm-j568

Magento Cross-Site Scripting (XSS) vulnerability

Published May 15, 2024Updated Nov 29, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.15	`2.1.15`Advisories →
Also listed as affected (18) `2.1.0` `2.1.0-rc1` `2.1.0-rc2` `2.1.0-rc3` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2` to before 2.2.6	`2.2.6`Advisories →
Also listed as affected (6) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5`

Description

Magento Commerce and Open Source 2.2.6 and 2.1.15 contain multiple security enhancements that help close Cross-Site Scripting (XSS) and other vulnerabilities.

References

Webgithub.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/2018-09-10.yaml ↗
Packagegithub.com/magento/magento2 ↗
Webweb.archive.org/web/20210802082439/https://magento.com/security/patches/magento-2.2.6-and-2.1.15-security-update ↗