PT-2024-40195 · Adobe · Magento Commerce+1

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Magento Commerce and Open Source versions prior to 2.3.0 Magento Commerce and Open Source versions prior to 2.2.7 Magento Commerce and Open Source versions prior to 2.1.16

Description: The issue concerns Remote Code Execution (RCE) and Cross-Site Scripting (XSS) among other vulnerabilities.

Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. For versions prior to 2.2.7, update to version 2.2.7 or later to resolve the issue. For versions prior to 2.1.16, update to version 2.1.16 or later to resolve the issue.

Related Identifiers

GHSA-8J7C-682X-R9F2

Affected Products

Magento Commerce

Magento Open Source

References · 4

• https://osv.dev/vulnerability/GHSA-8j7c-682x-r9f2 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/2018-11-28.yaml · Note
• https://web.archive.org/web/20210802095950/https://magento.com/security/patches/magento-2.2.7-and-2.1.16-security-update · Note