Skip to content

Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

Critical severity GitHub Reviewed Published May 15, 2024 to the GitHub Advisory Database

Package

composer magento/community-edition (Composer)

Affected versions

>= 2.1, < 2.1.14
>= 2.2, < 2.2.5

Patched versions

2.1.14
2.2.5

Description

Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

References

Published to the GitHub Advisory Database May 15, 2024
Reviewed May 15, 2024

Severity

Critical

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-5gmh-85x8-5cx7

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.