Iniciar sesión
Deutsch English Español Polski
Media

Magento Open Source allows Improper Access Control

  • Publicada: 27.03.2023
  • Actualizado: 11.10.2026 12:17

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer magento/community-edition >= 2.4.4-p1, < 2.4.4-p3, >= 2.4.5-p1, < 2.4.5-p2, = 2.4.4, = 2.4.5 2.4.4-p3, 2.4.5-p2
Paquete de Composer magento/project-community-edition <= 2.0.2 sin corrección
Magento (núcleo) magento/community-edition >= 2.4.4-p1, < 2.4.4-p3, >= 2.4.5-p1, < 2.4.5-p2, <= 2.0.2, = 2.4.4, = 2.4.5 2.4.4-p3, 2.4.5-p2

Referencias

Puntuación CVSS 5.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Debilidad (CWE)
CWE-284
Plataforma
Composer, Magento
Paquete
magento/community-edition, magento/project-community-edition
Publicada
27.03.2023
Actualizado
11.10.2026 12:17

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-4h7p-4vq8-g2gh - CC BY 4.0

Historial de vulnerabilidades: magento/community-edition

Todas las vulnerabilidades publicadas de este paquete (Magento (núcleo)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (360) en el archivo
Entradas en total
360
Primera → última
11.2019 10.2025
Sin corrección
3
Explotada en ataques
3

Distribución por gravedad

  • Crítica 47
  • Alta 104
  • Media 192
  • Baja 17

Divulgaciones por año

Gravedad:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Alta · 8.1 CVE-2025-54264 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  2. Magento provides incorrect authorization through a security feature bypass
    Alta · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, <= 2.0.2, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento Community Edition Improper Input Validation vulnerability
    Crítica · 9.1 Explotada en ataques CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 sin corrección
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Alta · 8.1 CVE-2025-49555 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  5. Magento vulnerable to denial of service
    Alta · 7.5 CVE-2025-49554 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    Alta · 7.5 CVE-2025-49556 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento Cross-site Scripting vulnerability
    Alta · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, <= 2.0.2, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  8. Magento Improper Authorization leading to security feature bypass
    Alta · 8.2 CVE-2025-43585 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  9. Magneto contains stored XSS vulnerability
    Crítica · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  10. Improper Authorization vulnerability in Magento and Adobe Commerce
    Crítica · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  11. Magento stored Cross-Site Scripting (XSS) vulnerability
    Alta · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Adobe Commerce Path Traversal
    Alta · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Improper Authorization vulnerability
    Alta · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Improper Access Control vulnerability
    Alta · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Open Source Improper Authorization vulnerability
    Alta · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  23. Magento Open Source Improper Access Control vulnerability
    Alta · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Stored Cross-Site Scripting (XSS) vulnerability
    Alta · 7.6 CVE-2024-39403 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  25. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    Alta · 8.1 CVE-2024-39400 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento Path Traversal vulnerability
    Alta · 7.7 CVE-2024-39399 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento does not properly restrict excessive authentication attempts
    Alta · 7.4 CVE-2024-39398 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento OS Command ('OS Command Injection') vulnerability
    Alta · 8.4 CVE-2024-39402 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    Alta · 8.4 CVE-2024-39401 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento Open Source Improper Authentication vulnerability
    Crítica · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  31. Magento Open Source Improper Authorization vulnerability
    Alta · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Crítica · 9.8 Explotada en ataques CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento RCE,XSS and other vulnerabilities
    Crítica ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  34. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Crítica ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  35. Magento Open Source Security Advisory: Patch SUPEE-10975
    Crítica ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  36. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Crítica ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  37. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Crítica ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  38. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Crítica ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  39. Magento Open Source allows Improper Input Validation
    Alta · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  40. Magento Open Source allows OS Command Injection
    Alta · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  41. Magento Open Source allows Cross-Site Scripting (XSS)
    Alta · 9.1 CVE-2024-20719 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  42. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Crítica · 9.1 CVE-2021-36021 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  43. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Crítica · 9.1 CVE-2021-36036 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  44. Magento XML Injection vulnerability in the Widgets Update Layout
    Crítica · 9.1 CVE-2021-36023 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  45. Magento Open Source allows Improper Neutralization of Special Elements Used
    Alta · 9.1 CVE-2023-38208 >= 2.4.6-p1, < 2.4.6-p2, >= 2.4.5-p1, < 2.4.5-p4, >= 2.4.4-p1, < 2.4.4-p5, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p2, 2.4.5-p4, 2.4.4-p5
  46. Magento Open Source allows Improper Neutralization of Special Elements Used
    Alta · 9.1 CVE-2023-29297 >= 2.4.5-p1, < 2.4.5-p3, >= 2.4.4-p1, < 2.4.4-p4, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.5-p3, 2.4.4-p4
  47. Magento Open Source allows Improper Access Control esta entrada
    Media · 5.3 CVE-2023-22250 >= 2.4.4-p1, < 2.4.4-p3, >= 2.4.5-p1, < 2.4.5-p2, <= 2.0.2, = 2.4.4, = 2.4.5 2.4.4-p3, 2.4.5-p2
  48. Magento Open Source allows XML Injection
    Alta · 7.5 CVE-2023-22247 >= 2.4.5-p1, < 2.4.5-p2, >= 2.4.4-p1, < 2.4.4-p3, <= 2.0.2, = 2.4.5, = 2.4.4 2.4.5-p2, 2.4.4-p3
  49. Magento Improper input validation vulnerability
    Alta · 8.8 CVE-2022-42344 < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  50. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    Alta · 10.0 CVE-2022-35698 >= 2.4.3-p1, <= 2.4.3-p3, <= 2.0.2, = 2.4.4-p1, = 2.4.4, = 2.4.5, = 2.4.3 sin corrección
  51. Magento Path Traversal vulnerability
    Alta · 8.5 CVE-2022-34254 >= 2.3.0, < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  52. Magento Improper Access Control vulnerability
    Alta · 8.8 CVE-2022-34255 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  53. Magento Improper Authorization vulnerability
    Alta · 7.5 CVE-2022-34256 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  54. Magento XML Injection vulnerability in the Widgets Module
    Crítica · 9.1 CVE-2022-34253 < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  55. Magento Broken authentication and session managememt
    Crítica · 9.8 CVE-2019-8149 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  56. Magento remote code execution vulnerability
    Alta · 8.8 CVE-2019-8154 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  57. Magento 2 Community Edition SQLi Vulnerability
    Crítica · 9.8 CVE-2019-7139 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  58. Magento XML Injection vulnerability in the 'City' field
    Alta CVE-2021-36020 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  59. Magento XML Injection vulnerability in the Widgets Update Layout
    Alta · 7.2 CVE-2021-36022 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  60. Magento is affected by an improper input validation vulnerability
    Alta · 8.8 CVE-2021-36032 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
Mostrar más (20) Mostrando 60 de 152

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.