Anmelden
Deutsch English Español Polski
Mittel

Magento Unrestricted file upload vulnerability

  • Veröffentlicht: 24.05.2022
  • Aktualisiert: 11.10.2026 11:17

An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Composer-Paket magento/community-edition >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.2.10, 2.3.3
Magento (Kern) magento/community-edition >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.2.10, 2.3.3

Verweise

CVSS-Wert 4.9/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Schwäche (CWE)
CWE-434
Plattform
Composer, Magento
Paket
magento/community-edition
Veröffentlicht
24.05.2022
Aktualisiert
11.10.2026 11:17

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-7pr3-34rg-g53m - CC BY 4.0

Schwachstellenhistorie: magento/community-edition

Alle veröffentlichten Schwachstellen dieses Pakets (Magento (Kern)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (360) im Archiv
Einträge insgesamt
360
Erste → letzte
11.2019 10.2025
Ohne Fix
3
In Angriffen ausgenutzt
3

Verteilung nach Schweregrad

  • Kritisch 47
  • Hoch 104
  • Mittel 192
  • Niedrig 17

Veröffentlichungen pro Jahr

Schweregrad:
  1. Magento Unrestricted file upload vulnerability dieser Eintrag
    Mittel · 4.9 CVE-2019-8140 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.2.10, 2.3.3
  2. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Hoch · 8.1 CVE-2025-54264 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento provides incorrect authorization through a security feature bypass
    Hoch · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, <= 2.0.2, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  4. Magento Community Edition Improper Input Validation vulnerability
    Kritisch · 9.1 In Angriffen ausgenutzt CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 keine Korrektur
  5. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Hoch · 8.1 CVE-2025-49555 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento vulnerable to denial of service
    Hoch · 7.5 CVE-2025-49554 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento has incorrect authorization issue that leads to arbitrary file system read
    Hoch · 7.5 CVE-2025-49556 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  8. Magento Cross-site Scripting vulnerability
    Hoch · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, <= 2.0.2, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  9. Magento Improper Authorization leading to security feature bypass
    Hoch · 8.2 CVE-2025-43585 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  10. Magneto contains stored XSS vulnerability
    Kritisch · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  11. Improper Authorization vulnerability in Magento and Adobe Commerce
    Kritisch · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Magento stored Cross-Site Scripting (XSS) vulnerability
    Hoch · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Path Traversal
    Hoch · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Adobe Commerce Improper Authorization vulnerability
    Hoch · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Hoch · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Hoch · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Hoch · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Hoch · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Hoch · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Hoch · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Improper Access Control vulnerability
    Hoch · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Hoch · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  23. Magento Open Source Improper Authorization vulnerability
    Hoch · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Open Source Improper Access Control vulnerability
    Hoch · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  25. Magento Stored Cross-Site Scripting (XSS) vulnerability
    Hoch · 7.6 CVE-2024-39403 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    Hoch · 8.1 CVE-2024-39400 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento Path Traversal vulnerability
    Hoch · 7.7 CVE-2024-39399 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento does not properly restrict excessive authentication attempts
    Hoch · 7.4 CVE-2024-39398 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    Hoch · 8.4 CVE-2024-39402 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento OS Command ('OS Command Injection') vulnerability
    Hoch · 8.4 CVE-2024-39401 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  31. Magento Open Source Improper Authentication vulnerability
    Kritisch · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source Improper Authorization vulnerability
    Hoch · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Kritisch · 9.8 In Angriffen ausgenutzt CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  34. Magento RCE,XSS and other vulnerabilities
    Kritisch ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  35. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Kritisch ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  36. Magento Open Source Security Advisory: Patch SUPEE-10975
    Kritisch ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  37. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Kritisch ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  38. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Kritisch ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  39. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Kritisch ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  40. Magento Open Source allows Improper Input Validation
    Hoch · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  41. Magento Open Source allows OS Command Injection
    Hoch · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
Mehr anzeigen (20) 41 von 152 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.