Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
198 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these manipulations can lead to remote code execution.
Recommended action: Upgrade to 2.3.3, 2.2.10 or 2.1.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. The logging feature required for effective monitoring did not contain sufficent data to effectively track configuration changes. As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
Recommended action: Upgrade to 2.3.3, 2.2.10 or 2.1.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specification.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation. As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
Recommended action: Upgrade to 2.3.2-p2 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address.
Recommended action: Upgrade to 2.3.3, 2.2.10 or 2.1.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
Recommended action: Upgrade to 2.3.3, 2.2.10 or 2.1.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Failure to track admin actions related to design configuration could lead to repudiation attacks.
Recommended action: Upgrade to 2.3.3, 2.2.10 or 2.1.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with export data transfer privileges can craft a request to perform arbitrary file deletion.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload. As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
Recommended action: Upgrade to 2.3.2-p2 (pre-release), 2.2.10 or 1.9.4.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a malicious CSRF payload that can result in arbitrary command execution.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate session validation setting for a storefront that leads to insecure authentication and session management.
Recommended action: Upgrade to 2.3.2-p2 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via email template preview.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage email templates hierarchy to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage plugin functionality related to email templates to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage file upload controller for downloadable products to read/delete an arbitary files.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation.
Recommended action: Upgrade to 2.3.2-p1 (pre-release) or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature.
Recommended action: Upgrade to 2.3.3 or 2.2.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content page titles to inject malicious javascript.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.