Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
198 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to marketing email templates to inject malicious javascript.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure the catalog search.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack).
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage customer groups.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.
Recommended action: Upgrade to 2.3.2, 2.2.9 or 2.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.