magento/community-edition Security Advisories for 2.4.0 (41)
-
[HIGH] Magento Improper input validation vulnerability
PKSA-228k-hrjg-43zp CVE-2022-42344 GHSA-297f-r9w7-w492
Affected version: =2.4.4|>=2.4.0,<2.4.3-p3|<2.3.7-p4
Reported by:
GitHub -
[HIGH] Magento Path Traversal vulnerability
PKSA-rnsh-tzs8-qzqg CVE-2022-34254 GHSA-fx9g-g9q6-x3jx
Affected version: =2.4.4|>=2.4.0,<2.4.3-p3|>=2.3.0,<2.3.7-p4
Reported by:
GitHub -
[HIGH] Magento Improper Access Control vulnerability
PKSA-858j-1s59-ycmj CVE-2022-34255 GHSA-x95x-f4g9-mm85
Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4
Reported by:
GitHub -
[HIGH] Magento Improper Authorization vulnerability
PKSA-4kq2-8xg5-xc5f CVE-2022-34256 GHSA-r7mm-grf3-5fjv
Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4
Reported by:
GitHub -
[MEDIUM] Magento stored Cross-Site Scripting (XSS) vulnerability
PKSA-8rxk-pq5k-p21j CVE-2022-34257 GHSA-rg7p-wmgj-f374
Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4
Reported by:
GitHub -
[MEDIUM] Magento stored Cross-Site Scripting (XSS) vulnerability
PKSA-48rk-jcyb-xpsd CVE-2022-34258 GHSA-5m55-g8pv-x8ww
Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4
Reported by:
GitHub -
[MEDIUM] Magento Improper Access Control vulnerability
PKSA-1w77-ttnz-wb1k CVE-2022-34259 GHSA-9wjf-94h3-r4rh
Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|>=2.3.0,<2.3.7-p4
Reported by:
GitHub -
[CRITICAL] Magento XML Injection vulnerability in the Widgets Module
PKSA-ky72-2cr3-p8cw CVE-2022-34253 GHSA-cj7w-pm77-hvg6
Affected version: >=2.4.0,<2.4.3-p3|>=2.4.4,<2.4.5|<2.3.7-p4
Reported by:
GitHub -
[LOW] Magento Information Disclosure vulnerability
PKSA-rk1n-456t-jj3q CVE-2021-28566 GHSA-w942-fw92-mqm2
Affected version: >=2.3.0,<2.3.7|>=2.4.0,<2.4.2-p1
Reported by:
GitHub -
[MEDIUM] Magento Improper Authorization vulnerability in the customers module
PKSA-98vv-8nyb-ffc5 CVE-2021-28567 GHSA-cc3w-r3w8-hfh7
Affected version: <2.3.7|>=2.4.0,<2.4.2-p1
Reported by:
GitHub -
[MEDIUM] Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies
PKSA-8582-qjd4-1g8s CVE-2021-28556 GHSA-39ch-rg26-gmq5
Affected version: <2.3.7|>=2.4.0,<2.4.2-p1
Reported by:
GitHub -
[MEDIUM] Magento Unauthorized access to restricted resources
PKSA-y9kv-15rd-x7qv CVE-2021-28563 GHSA-q9xx-4689-gvv5
Affected version: <2.3.7|>=2.4.0,<2.4.2-p1
Reported by:
GitHub -
[HIGH] Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats
PKSA-n22f-w4n6-g3fx CVE-2021-28583 GHSA-7gh6-f4jh-3crq
Affected version: <2.3.7|>=2.4.0,<2.4.2-p1
Reported by:
GitHub -
[MEDIUM] Magento Path Traversal vulnerability
PKSA-kfxc-51yz-zbnf CVE-2021-28584 GHSA-7gpv-xrjr-f5h4
Affected version: <2.3.7|>=2.4.0,<2.4.2-p1
Reported by:
GitHub -
[MEDIUM] Magento Improper input validation vulnerability
PKSA-2gm6-m4rp-6fvz CVE-2021-28585 GHSA-c38m-9668-6j2w
Affected version: <2.3.7|>=2.4.0,<2.4.2-p1
Reported by:
GitHub -
[MEDIUM] Magento Insufficient Session Expiration
PKSA-48bg-fxg1-vkpy CVE-2021-21031 GHSA-4h3p-63x6-vwg2
Affected version: <2.3.6|>=2.4.0,<2.4.1-p1
Reported by:
GitHub -
[CRITICAL] Magento XML injection in the Widgets module
PKSA-6mpp-zh74-59gd CVE-2021-21019 GHSA-mw95-gmw4-883p
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6-p1
Reported by:
GitHub -
[MEDIUM] Magento Insecure Direct Object Reference (IDOR) in the product module
PKSA-tw4y-fk6r-w8j9 CVE-2021-21022 GHSA-8pfq-g48p-x7w8
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6-p1
Reported by:
GitHub -
[MEDIUM] Magento stored cross-site scripting vulnerability in the admin console
PKSA-cv47-f2nq-tgnw CVE-2021-21023 GHSA-h5rm-m772-6qcx
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6
Reported by:
GitHub -
[CRITICAL] Magento Blind SQL Injection in the Search module
PKSA-392g-81d8-vhhm CVE-2021-21024 GHSA-rj4f-cp4v-hvcv
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6-p1
Reported by:
GitHub -
[MEDIUM] Magento improper authorization vulnerability in the integrations module
PKSA-m4ck-h7wd-91mj CVE-2021-21026 GHSA-crjc-2v9m-8w7r
Affected version: >=2.4.0,<2.4.2|<2.3.6-p1
Reported by:
GitHub -
[MEDIUM] Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API
PKSA-njqv-gp7y-zc74 CVE-2021-21027 GHSA-h4xc-577p-hgj9
Affected version: >=2.4.0,<2.4.2|<2.3.6-p1
Reported by:
GitHub -
[MEDIUM] Magento Reflected Cross-site Scripting vulnerability via 'file' parameter
PKSA-m8rz-jc2c-7m91 CVE-2021-21029 GHSA-jwxh-wj79-ccm6
Affected version: >=2.4.0,<2.4.2|<2.3.6-p1
Reported by:
GitHub -
[HIGH] Magento stored cross-site scripting (XSS) in the customer address upload feature
PKSA-7rd2-y8tt-4pxt CVE-2021-21030 GHSA-6988-g89m-27vf
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6
Reported by:
GitHub -
[MEDIUM] Magento Insufficient Session Expiration
PKSA-whxx-hqxp-qv8z CVE-2021-21032 GHSA-4jfq-f8hc-775q
Affected version: <2.3.6|>=2.4.0,<2.4.1-p1
Reported by:
GitHub -
[CRITICAL] Magento vulnerable to a file upload restriction bypass
PKSA-yt4p-w22g-fdxr CVE-2021-21014 GHSA-269w-pqc7-68q9
Affected version: >=2.4.0,<2.4.2|<2.3.6-p1
Reported by:
GitHub -
[CRITICAL] Magento OS Command Injection
PKSA-msgn-qz5c-7csr CVE-2021-21018 GHSA-rv48-v862-mp92
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6
Reported by:
GitHub -
[MEDIUM] Magento Improper Access Control
PKSA-rx41-6862-pt82 CVE-2021-21020 GHSA-2j6v-829g-885q
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6
Reported by:
GitHub -
[CRITICAL] Magento XPath Injection
PKSA-q4sd-rbfw-bn9m CVE-2021-21025 GHSA-h437-qjj9-vmq4
Affected version: >=2.4.0,<2.4.1-p1|<2.3.6-p1
Reported by:
GitHub -
[HIGH] Magento OS command injection via the customer attribute save controller
PKSA-q4dq-szdv-ng3x CVE-2021-21015 GHSA-w2p4-2c8c-2g7h
Affected version: >=2.4.0,<2.4.2|<2.3.6-p1
Reported by:
GitHub -
[CRITICAL] Magento OS command injection via the WebAPI
PKSA-g12r-tk3d-rbjb CVE-2021-21016 GHSA-792f-c8mp-2cr5
Affected version: >=2.4.0,<2.4.2|<2.3.6-p1
Reported by:
GitHub -
[MEDIUM] Magento incorrect permissions vulnerability in the Inventory module
PKSA-1278-33g9-g9k5 CVE-2020-24405 GHSA-p7m7-j8jv-393q
Affected version: >=2.4.0,<2.4.1|<=2.3.5-p2
Reported by:
GitHub -
[LOW] Magento information disclosure vulnerability
PKSA-8tng-rkwh-ddv6 CVE-2020-24406 GHSA-mr8q-7f5j-wc79
Affected version: =2.4.0|<2.3.6
Reported by:
GitHub -
[CRITICAL] Magento 2 Community Edition RCE via Unsafe File Upload
PKSA-wd67-z9cy-8cfd CVE-2020-24407 GHSA-7pxg-6p87-8c9v
Affected version: <=2.4.0
Reported by:
GitHub -
[HIGH] Magento SQL Injection vulnerability
PKSA-6ppv-y2gp-4ffp CVE-2020-24400 GHSA-pf6w-3pfw-fxvw
Affected version: =2.4.0|<2.3.6
Reported by:
GitHub -
[MEDIUM] Magento 2 Community Edition Incorrect Authorization
PKSA-ds46-4wsj-k4fh CVE-2020-24401 GHSA-f2g3-3c6q-4478
Affected version: <=2.4.0
Reported by:
GitHub -
[MEDIUM] Magento incorrect permissions vulnerability in the Integrations component
PKSA-36s1-jszf-m523 CVE-2020-24402 GHSA-hvf5-4jr9-fghh
Affected version: =2.4.0|<2.3.6
Reported by:
GitHub -
[LOW] Magento incorrect user permissions vulnerability within the Inventory component
PKSA-g8kq-c8yg-8h4p CVE-2020-24403 GHSA-39rw-4m66-82gf
Affected version: =2.4.0|<2.3.6
Reported by:
GitHub -
[LOW] Magento 2 Community Edition vulnerable to Improper Authorization
PKSA-jj68-r2qs-83z3 CVE-2020-24404 GHSA-rwf7-652f-76mv
Affected version: =2.4.0|<2.3.6
Reported by:
GitHub -
[MEDIUM] Magento 2 Community Edition XSS Vulnerability
PKSA-rs6t-7sf8-mdt8 CVE-2020-24408 GHSA-jxjc-6xmh-h7mg
Affected version: <=2.4.0
Reported by:
GitHub -
[CRITICAL] Magento improper input validation vulnerability
PKSA-bck7-ptrd-xq9f CVE-2022-24086 GHSA-f8fv-f786-9933
Affected version: >=2.4.0,<2.4.3-p2|>=2.3.3-p1,<2.3.7-p3
Reported by:
GitHub