PT-2024-40249 · Adobe+1 · Magento Commerce+2
Published
2024-05-15
·
Updated
2024-05-15
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
Magento Commerce versions 1.9.0.0 through 1.14.4.0
Magento Open Source versions 1.5.0.0 through 1.9.4.0
Description:
The issue concerns multiple vulnerabilities in Magento, including remote code execution (RCE), cross-site scripting (XSS), and cross-site request forgery (CSRF). These vulnerabilities can be exploited through various means, such as API endpoints, customer import, and unauthorized uploads. The vulnerabilities also include issues related to brute force requests, credit card storage, and outdated jQuery causing PCI scanning failures.
Recommendations:
For Magento Commerce versions 1.9.0.0 through 1.14.4.0: Apply SUPEE-10975 or upgrade to Magento Commerce 1.14.4.0.
For Magento Open Source versions 1.5.0.0 through 1.9.4.0: Apply SUPEE-10975 or upgrade to Magento Open Source 1.9.4.0.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Magento Commerce
Magento Open Source
Jquery