Iniciar sesión
Deutsch English Español Polski
Media

Magento Insufficient authorization check when adding users to company accounts

  • Publicada: 24.05.2022
  • Actualizado: 11.10.2026 11:18

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer magento/community-edition >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
Magento (núcleo) magento/community-edition >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2

Referencias

Puntuación CVSS 6.5/10
Vector CVSS
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Debilidad (CWE)
CWE-285
Plataforma
Composer, Magento
Paquete
magento/community-edition
Publicada
24.05.2022
Actualizado
11.10.2026 11:18

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-pfxv-66r9-4gqw - CC BY 4.0

Historial de vulnerabilidades: magento/community-edition

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (360) en el archivo
Entradas en total
360
Primera → última
11.2019 10.2025
Sin corrección
3
Explotada en ataques
3

Distribución por gravedad

  • Crítica 47
  • Alta 104
  • Media 192
  • Baja 17

Divulgaciones por año

Gravedad:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Alta · 8.1 CVE-2025-54264 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  2. Magento provides incorrect authorization through a security feature bypass
    Alta · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento Community Edition Improper Input Validation vulnerability
    Crítica · 9.1 Explotada en ataques CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 sin corrección
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Alta · 8.1 CVE-2025-49555 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  5. Magento vulnerable to denial of service
    Alta · 7.5 CVE-2025-49554 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    Alta · 7.5 CVE-2025-49556 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento Cross-site Scripting vulnerability
    Alta · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  8. Magento Improper Authorization leading to security feature bypass
    Alta · 8.2 CVE-2025-43585 >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  9. Magneto contains stored XSS vulnerability
    Crítica · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  10. Improper Authorization vulnerability in Magento and Adobe Commerce
    Crítica · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  11. Magento stored Cross-Site Scripting (XSS) vulnerability
    Alta · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Adobe Commerce Path Traversal
    Alta · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Improper Authorization vulnerability
    Alta · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Improper Access Control vulnerability
    Alta · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Open Source Improper Authorization vulnerability
    Alta · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  23. Magento Open Source Improper Access Control vulnerability
    Alta · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Stored Cross-Site Scripting (XSS) vulnerability
    Alta · 7.6 CVE-2024-39403 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  25. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    Alta · 8.1 CVE-2024-39400 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento Path Traversal vulnerability
    Alta · 7.7 CVE-2024-39399 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento does not properly restrict excessive authentication attempts
    Alta · 7.4 CVE-2024-39398 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento OS Command ('OS Command Injection') vulnerability
    Alta · 8.4 CVE-2024-39402 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    Alta · 8.4 CVE-2024-39401 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento Open Source Improper Authentication vulnerability
    Crítica · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  31. Magento Open Source Improper Authorization vulnerability
    Alta · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Crítica · 9.8 Explotada en ataques CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento RCE,XSS and other vulnerabilities
    Crítica ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  34. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Crítica ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  35. Magento Open Source Security Advisory: Patch SUPEE-10975
    Crítica ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  36. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Crítica ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  37. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Crítica ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  38. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Crítica ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  39. Magento Open Source allows Improper Input Validation
    Alta · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  40. Magento Open Source allows OS Command Injection
    Alta · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  41. Magento Open Source allows Cross-Site Scripting (XSS)
    Alta · 9.1 CVE-2024-20719 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  42. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Crítica · 9.1 CVE-2021-36021 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  43. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Crítica · 9.1 CVE-2021-36036 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  44. Magento XML Injection vulnerability in the Widgets Update Layout
    Crítica · 9.1 CVE-2021-36023 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  45. Magento Open Source allows Improper Neutralization of Special Elements Used
    Alta · 9.1 CVE-2023-38208 >= 2.4.6-p1, < 2.4.6-p2, >= 2.4.5-p1, < 2.4.5-p4, >= 2.4.4-p1, < 2.4.4-p5, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p2, 2.4.5-p4, 2.4.4-p5
  46. Magento Open Source allows Improper Neutralization of Special Elements Used
    Alta · 9.1 CVE-2023-29297 >= 2.4.5-p1, < 2.4.5-p3, >= 2.4.4-p1, < 2.4.4-p4, = 2.4.6, = 2.4.5, = 2.4.4 2.4.5-p3, 2.4.4-p4
  47. Magento Open Source allows XML Injection
    Alta · 7.5 CVE-2023-22247 >= 2.4.5-p1, < 2.4.5-p2, >= 2.4.4-p1, < 2.4.4-p3, = 2.4.5, = 2.4.4 2.4.5-p2, 2.4.4-p3
  48. Magento Improper input validation vulnerability
    Alta · 8.8 CVE-2022-42344 < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  49. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    Alta · 10.0 CVE-2022-35698 >= 2.4.3-p1, <= 2.4.3-p3, = 2.4.4-p1, = 2.4.4, = 2.4.5, = 2.4.3 sin corrección
  50. Magento Path Traversal vulnerability
    Alta · 8.5 CVE-2022-34254 >= 2.3.0, < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  51. Magento Improper Access Control vulnerability
    Alta · 8.8 CVE-2022-34255 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  52. Magento Improper Authorization vulnerability
    Alta · 7.5 CVE-2022-34256 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  53. Magento XML Injection vulnerability in the Widgets Module
    Crítica · 9.1 CVE-2022-34253 < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  54. Magento Broken authentication and session managememt
    Crítica · 9.8 CVE-2019-8149 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  55. Magento remote code execution vulnerability
    Alta · 8.8 CVE-2019-8154 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  56. Magento 2 Community Edition SQLi Vulnerability
    Crítica · 9.8 CVE-2019-7139 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  57. Magento XML Injection vulnerability in the 'City' field
    Alta CVE-2021-36020 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  58. Magento XML Injection vulnerability in the Widgets Update Layout
    Alta · 7.2 CVE-2021-36022 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  59. Magento is affected by an improper input validation vulnerability
    Alta · 8.8 CVE-2021-36032 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  60. Magento has an XML Injection vulnerability
    Crítica CVE-2021-36028 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  61. Magento is affected by an improper input validation vulnerability while saving a customer's details
    Crítica · 9.1 CVE-2021-36025 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  62. Magento is affected by an os command injection via the Data collection endpoint
    Alta · 7.2 CVE-2021-36024 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  63. Magento XML Injection vulnerability in the Widgets Module
    Crítica CVE-2021-36033 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  64. Magento allows attackers to alter the price of items
    Alta CVE-2021-36030 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  65. Magento improper authorization vulnerability
    Alta · 7.2 CVE-2021-36029 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  66. Magento Path Traversal vulnerability via the `theme[preview_image]` parameter
    Alta CVE-2021-36031 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  67. Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension
    Alta · 8.0 CVE-2021-36043 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  68. Magento executes code via the API File Option Upload Extension
    Crítica · 9.1 CVE-2021-36042 >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  69. Magento vulnerable to file upload attack
    Alta · 7.2 CVE-2021-36041 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  70. Magento affected by remote code execution via a file upload
    Alta · 7.2 CVE-2021-36034 >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  71. Magento has a file extension restrictions bypass
    Crítica · 9.1 CVE-2021-36040 >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  72. Magento affected by a server-side denial-of-service using a GraphQL field
    Alta · 7.5 CVE-2021-36044 >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  73. Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats
    Alta · 7.5 CVE-2021-28583 >= 2.4.0, < 2.4.2-p1, < 2.3.7 2.4.2-p1, 2.3.7
  74. Magento stored cross-site scripting (XSS) in the customer address upload feature
    Alta · 8.1 CVE-2021-21030 < 2.3.6, >= 2.4.0, < 2.4.1-p1 2.3.6, 2.4.1-p1
  75. Magento XML injection in the Widgets module
    Crítica · 9.1 CVE-2021-21019 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1 2.3.6-p1, 2.4.1-p1
  76. Magento Blind SQL Injection in the Search module
    Crítica · 9.1 CVE-2021-21024 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1 2.3.6-p1, 2.4.1-p1
  77. Magento vulnerable to a file upload restriction bypass
    Crítica · 9.1 CVE-2021-21014 < 2.3.6-p1, >= 2.4.0, < 2.4.2 2.3.6-p1, 2.4.2
  78. Magento XPath Injection
    Crítica · 9.1 CVE-2021-21025 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1 2.3.6-p1, 2.4.1-p1
  79. Magento OS Command Injection
    Crítica · 9.1 CVE-2021-21018 < 2.3.6, >= 2.4.0, < 2.4.1-p1 2.3.6, 2.4.1-p1
  80. Magento OS command injection via the WebAPI
    Crítica · 9.1 CVE-2021-21016 < 2.3.6-p1, >= 2.4.0, < 2.4.2 2.3.6-p1, 2.4.2
  81. Magento OS command injection via the customer attribute save controller
    Alta · 8.0 CVE-2021-21015 < 2.3.6-p1, >= 2.4.0, < 2.4.2 2.3.6-p1, 2.4.2
  82. Magento 2 Community Edition RCE via Unsafe File Upload
    Crítica · 9.1 CVE-2020-24407 < 2.4.1 2.4.1
  83. Magento SQL Injection vulnerability
    Alta · 7.1 CVE-2020-24400 < 2.3.6, >= 2.4.0, < 2.4.1 2.3.6, 2.4.1
  84. Magento DOM-based Cross-site scripting vulnerability
    Crítica · 9.6 CVE-2020-9691 < 2.3.5-p2 2.3.5-p2
  85. Magento business logic error vulnerability
    Crítica · 9.8 CVE-2020-9630 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  86. Magento security mitigation bypass vulnerability
    Crítica · 9.8 CVE-2020-9632 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  87. Magento security mitigation bypass vulnerability
    Crítica · 9.8 CVE-2020-9631 >= 2.3.0, < 2.3.4-p2, <= 2.2.11 2.3.4-p2
  88. Magento defense-in-depth security mitigation vulnerability
    Alta · 7.5 CVE-2020-9591 >= 2.3.0, < 2.3.4-p2, <= 2.2.11 2.3.4-p2
  89. Magento Defense-in-depth security mitigation vulnerability
    Crítica · 9.8 CVE-2020-9585 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  90. Magento command injection vulnerability
    Crítica · 9.8 CVE-2020-9583 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  91. Magento Signature verification bypass
    Alta · 7.2 CVE-2020-9588 < 2.3.4-p2 2.3.4-p2
  92. Magento command injection vulnerability
    Crítica · 9.8 CVE-2020-9582 >= 2.3.0, < 2.3.4-p2, < 2.2.12 2.3.4-p2, 2.2.12
  93. Magento authorization bypass vulnerability
    Alta · 7.5 CVE-2020-9587 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  94. Magento command injection vulnerability
    Crítica · 9.8 CVE-2020-9578 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  95. Magento Security mitigation bypass vulnerability
    Crítica · 9.8 CVE-2020-9580 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  96. Magento command injection vulnerability
    Crítica · 9.8 CVE-2020-9576 >= 2.3.0, < 2.3.4-p2, < 2.2.12 2.3.4-p2, 2.2.12
  97. Magento Security mitigation bypass vulnerability
    Crítica · 9.8 CVE-2020-9579 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  98. Magento security bypass vulnerability
    Crítica · 9.8 CVE-2020-3718 >= 2.3.0, < 2.3.4, < 2.2.11 2.3.4, 2.2.11
  99. Magento deserialization vulnerability
    Crítica · 9.8 CVE-2020-3716 >= 2.2.0, < 2.2.11, >= 2.3.0, < 2.3.4 2.2.11, 2.3.4
  100. Magento sql injection vulnerability
    Alta · 7.5 CVE-2020-3719 >= 2.3.0, < 2.3.4, < 2.2.11 2.3.4, 2.2.11
  101. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-8150 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  102. Magento 2 Community Edition SSRF vulnerability
    Alta · 7.2 CVE-2019-8156 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  103. Magento Server-Side Request Forgery (SSRF)
    Alta · 7.2 CVE-2019-8151 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  104. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-8159 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p2 2.2.10, 2.3.2-p2
  105. Magento 2 Community Edition XML Injection
    Crítica · 9.8 CVE-2019-8158 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  106. Magento 2 Community Edition RCE Vulnerability
    Crítica · 9.8 CVE-2019-8144 >= 2.3, < 2.3.2-p1 2.3.2-p1
  107. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-8137 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  108. Magento SQL injection via marketing account with access to email templates variables
    Alta · 8.8 CVE-2019-8134 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  109. Magento 2 Community Edition RCE Vulnerability
    Alta · 7.2 CVE-2019-8141 >= 2.1.0, < 2.1.19, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.1.19, 2.2.10, 2.3.3
  110. Magento 2 Community Edition Insecure Component
    Crítica · 9.8 CVE-2019-8136 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  111. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-8122 >= 2.1.0, < 2.1.19, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.1.19, 2.2.10, 2.3.3
  112. Magento SQL injection vulnerability
    Alta · 8.8 CVE-2019-8130 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  113. Magento 2 Community Edition RCE Vulnerability
    Alta · 7.2 CVE-2019-8119 >= 2.1.0, < 2.1.19, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.1.19, 2.2.10, 2.3.3
  114. Magento 2 Community Edition SQLi Vulnerability
    Alta · 8.8 CVE-2019-8127 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  115. Magento 2 Community Edition RCE Vulnerability
    Alta · 7.2 CVE-2019-8114 < 1.9.4.3, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 1.9.4.3, 2.2.10, 2.3.2-p2
  116. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-8111 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  117. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-8110 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  118. Magento Information Disclosure via File upload functionality
    Alta · 8.8 CVE-2019-8093 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  119. Magento 2 Community Edition Security Bypass
    Alta · 7.5 CVE-2019-8112 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  120. Magento 2 Community Edition RCE Vulnerability via CSRF
    Alta · 8.0 CVE-2019-8109 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  121. Magento 2 Community Edition Access Control Bypass
    Alta · 7.5 CVE-2019-7950 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  122. Magento 2 Community Edition Information Leak
    Alta · 7.5 CVE-2019-7951 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  123. Magento 2 Community Edition RCE
    Alta · 7.2 CVE-2019-7942 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  124. Magento 2 Community Unrestricted File Upload
    Alta · 7.2 CVE-2019-7930 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  125. Magento 2 Community Edition RCE Vulnerability
    Alta · 7.2 CVE-2019-7932 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  126. Magento 2 Community Edition DoS vulnerability
    Alta · 7.5 CVE-2019-7928 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  127. Magento 2 Community Edition DoS vulnerability
    Alta · 7.5 CVE-2019-7915 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  128. Magento Filter extension bypass via crafted store configuration keys
    Alta · 7.2 CVE-2019-7912 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  129. Magento 2 Community Edition SSRF vulnerability
    Alta · 7.2 CVE-2019-7913 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  130. Magento 2 Community Edition SSRF vulnerability
    Alta · 7.2 CVE-2019-7923 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  131. Magento 2 Community Edition Server-Side Request Forgery vulnerability
    Alta · 7.2 CVE-2019-7911 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  132. Magento 2 Community Edition RCE Vulnerability
    Alta · 7.2 CVE-2019-7896 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  133. Magento 2 Community Edition RCE Vulnerability
    Alta · 7.2 CVE-2019-7895 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  134. Magento 2 Community Edition RCE Vulnerability
    Alta · 7.2 CVE-2019-7903 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  135. Magento 2 Community Edition IDOR Vulnerability
    Alta · 7.3 CVE-2019-7890 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  136. Magento 2 Community Edition RCE Vulnerability via SSRF
    Alta · 7.2 CVE-2019-7892 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  137. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-7885 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  138. Magento 2 Community Edition Cryptographic Flaw
    Alta · 7.5 CVE-2019-7886 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  139. Magento 2 Community Edition RCE Vulnerability
    Alta · 8.8 CVE-2019-7876 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  140. Magento Insufficient authorization check when adding users to company accounts esta entrada
    Media · 6.5 CVE-2019-7872 >= 2.1, < 2.1.18, >= 2.2, < 2.2.9, >= 2.3, < 2.3.2 2.1.18, 2.2.9, 2.3.2
Mostrar más (12) Mostrando 140 de 152

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.