p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости magento/community-edition · Страница 4

За последние 30 дней в magento/community-edition опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 360

  1. CVE-2024-45134

    Низкий · CVSS 2.7EPSS 0,63%Есть исправление

    Adobe Commerce | Information Exposure (CWE-200)

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p11
    • Обновитесь до 2.4.5-p10
    • Обновитесь до 2.4.6-p8
    • Обновитесь до 2.4.7-p3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  2. CVE-2024-45129

    Средний · CVSS 4.3EPSS 0,53%Есть исправление

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p11
    • Обновитесь до 2.4.5-p10
    • Обновитесь до 2.4.6-p8
    • Обновитесь до 2.4.7-p3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  3. CVE-2024-45118

    Средний · CVSS 6.5EPSS 0,64%Есть исправление

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have high impact on integrity. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p11
    • Обновитесь до 2.4.5-p10
    • Обновитесь до 2.4.6-p8
    • Обновитесь до 2.4.7-p3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  4. CVE-2024-45149

    Низкий · CVSS 2.7EPSS 0,48%Есть исправление

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p11
    • Обновитесь до 2.4.5-p10
    • Обновитесь до 2.4.6-p8
    • Обновитесь до 2.4.7-p3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  5. CVE-2024-45125

    Средний · CVSS 4.3EPSS 0,53%Есть исправление

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to have a low impact on integrity. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p11
    • Обновитесь до 2.4.5-p10
    • Обновитесь до 2.4.6-p8
    • Обновитесь до 2.4.7-p3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  6. CVE-2024-39419

    Средний · CVSS 4.3EPSS 0,43%Есть исправление

    A user without ship permissions can ship the orders

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  7. CVE-2024-39403

    Высокий · CVSS 7.6EPSS 0,54%Есть исправление

    Stored XSS through Webhook module public key configuration

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  8. CVE-2024-39418

    Средний · CVSS 5.4EPSS 0,41%Есть исправление

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  9. CVE-2024-39413

    Средний · CVSS 4.3EPSS 0,44%Есть исправление

    An unauthorized user can export the Invoiced Sales Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  10. CVE-2024-39399

    Высокий · CVSS 7.7EPSS 0,91%Есть исправление

    [Paris] Path Traversal lead to local file read

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  11. CVE-2024-39408

    Средний · CVSS 4.3EPSS 0,49%Есть исправление

    Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changeson behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  12. CVE-2024-39417

    Средний · CVSS 4.3EPSS 0,44%Есть исправление

    An unauthorized user can export the Shipping Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  13. CVE-2024-39410

    Средний · CVSS 4.3EPSS 0,49%Есть исправление

    Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  14. CVE-2024-39407

    Средний · CVSS 4.3EPSS 0,43%Есть исправление

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  15. CVE-2024-39398

    Высокий · CVSS 7.4EPSS 0,86%Есть исправление

    OTP 2FA can be bruteforced

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  16. CVE-2024-39401

    Высокий · CVSS 8.4EPSS 1,67%Есть исправление

    Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  17. CVE-2024-39409

    Средний · CVSS 4.3EPSS 0,49%Есть исправление

    Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  18. CVE-2024-39411

    Средний · CVSS 4.3EPSS 0,44%Есть исправление

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  19. CVE-2024-39416

    Средний · CVSS 4.3EPSS 0,42%Есть исправление

    Unauthorized user can export Orders Sale Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  20. CVE-2024-39414

    Средний · CVSS 4.3EPSS 0,44%Есть исправление

    Being able to import/export tax rates without proper privileges

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →