Iniciar sesión
Deutsch English Español Polski
Crítica

Magento Open Source Security Advisory: Patch SUPEE-10975

  • Publicada: 15.05.2024
  • Actualizado: 11.10.2026 11:18

Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated:

  • PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication
  • MAG-23: M1 Credit Card Storage Capability
  • PRODSECBUG-2149: Authenticated RCE using customer import
  • PRODSECBUG-2159: API Based RCE Vulnerability
  • PRODSECBUG-2156: RCE Via Unauthorized Upload
  • PRODSECBUG-2155: Authenticated RCE using dataflow
  • PRODSECBUG-2053: Prevents XSS in Newsletter Template
  • PRODSECBUG-2142: XSS in CMS Preview
  • PRODSECBUG-1860: Admin Account XSS Attack Cessation via Filename
  • PRODSECBUG-2119: EE Patch to include names in templates
  • PRODSECBUG-2129: XSS in Google Analytics Vulnerability
  • PRODSECBUG-2019: Merchant Wishlist Security Strengthening
  • PRODSECBUG-2104: Send to a Friend Vulnerability
  • PRODSECBUG-2125: CSRF on deletion of Blocks Vulnerability
  • PRODSECBUG-2088: CSRF Vulnerability related to Customer Group Deletion
  • PRODSECBUG-2140: CSRF on deletion of Site Map
  • PRODSECBUG-2108: Outdated jQuery causing PCI scanning failures
  • MAG-12, MAG-2: Encryption Keys Stored in Plain Text
  • PRODSECBUG-2141: Unauthorized Admin Panel Bypass

Patching and Upgrading:

Patches and upgrades are available for the following Magento versions:

Magento Commerce 1.9.0.0-1.14.4.0: Apply SUPEE-10975 or upgrade to Magento Commerce 1.14.4.0. Magento Open Source 1.5.0.0-1.9.4.0: Apply SUPEE-10975 or upgrade to Magento Open Source 1.9.4.0.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer magento/community-edition >= 1.9.0.0, < 1.14.4.0 1.14.4.0
Magento (núcleo) magento/community-edition >= 1.9.0.0, < 1.14.4.0 1.14.4.0

Referencias

Puntuación CVSS -
Debilidad (CWE)
-
Plataforma
Composer, Magento
Paquete
magento/community-edition
Publicada
15.05.2024
Actualizado
11.10.2026 11:18

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-cv25-3pxr-4q7x - CC BY 4.0

Historial de vulnerabilidades: magento/community-edition

Todas las vulnerabilidades publicadas de este paquete (Magento (núcleo)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (360) en el archivo
Entradas en total
360
Primera → última
11.2019 10.2025
Sin corrección
3
Explotada en ataques
3

Distribución por gravedad

  • Crítica 47
  • Alta 104
  • Media 192
  • Baja 17

Divulgaciones por año

Gravedad:
  1. Magento Open Source Security Advisory: Patch SUPEE-10975 esta entrada
    Crítica ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  2. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Alta · 8.1 CVE-2025-54264 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento provides incorrect authorization through a security feature bypass
    Alta · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, <= 2.0.2, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  4. Magento Community Edition Improper Input Validation vulnerability
    Crítica · 9.1 Explotada en ataques CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 sin corrección
  5. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Alta · 8.1 CVE-2025-49555 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento vulnerable to denial of service
    Alta · 7.5 CVE-2025-49554 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento has incorrect authorization issue that leads to arbitrary file system read
    Alta · 7.5 CVE-2025-49556 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  8. Magento Cross-site Scripting vulnerability
    Alta · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, <= 2.0.2, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  9. Magento Improper Authorization leading to security feature bypass
    Alta · 8.2 CVE-2025-43585 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  10. Magneto contains stored XSS vulnerability
    Crítica · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  11. Improper Authorization vulnerability in Magento and Adobe Commerce
    Crítica · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Magento stored Cross-Site Scripting (XSS) vulnerability
    Alta · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Path Traversal
    Alta · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Adobe Commerce Improper Authorization vulnerability
    Alta · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Alta · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Improper Access Control vulnerability
    Alta · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
Mostrar más (20) Mostrando 21 de 151

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.