Zaloguj się
Deutsch English Español Polski
Średnia

Magento 2 Community Edition XSS Vulnerability

  • Ujawniono: 24.05.2022
  • Aktualizacja: 11.10.2026 11:17

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via customer attribute label.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka Composer magento/community-edition >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
Magento (rdzeń) magento/community-edition >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1

Odnośniki

Ocena CVSS 5.4/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Słabość (CWE)
CWE-79
Platforma
Composer, Magento
Paczka
magento/community-edition
Ujawniono
24.05.2022
Aktualizacja
11.10.2026 11:17

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-v8fg-p27h-mxjp - CC BY 4.0

Historia podatności: magento/community-edition

Wszystkie opisane podatności tej paczki (Paczka Composer), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (360) w archiwum
Wszystkich wpisów
360
Pierwsza → ostatnia
11.2019 10.2025
Bez poprawki
3
Wykorzystywana w atakach
3

Rozkład istotności

  • Krytyczna 47
  • Wysoka 104
  • Średnia 192
  • Niska 17

Ujawnienia w latach

Istotność:
  1. Magento 2 Community Edition XSS Vulnerability ten wpis
    Średnia · 5.4 CVE-2019-8147 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  2. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Wysoka · 8.1 CVE-2025-54264 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento provides incorrect authorization through a security feature bypass
    Wysoka · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  4. Magento Community Edition Improper Input Validation vulnerability
    Krytyczna · 9.1 Wykorzystywana w atakach CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 brak poprawki
  5. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Wysoka · 8.1 CVE-2025-49555 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento vulnerable to denial of service
    Wysoka · 7.5 CVE-2025-49554 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento has incorrect authorization issue that leads to arbitrary file system read
    Wysoka · 7.5 CVE-2025-49556 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  8. Magento Cross-site Scripting vulnerability
    Wysoka · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  9. Magento Improper Authorization leading to security feature bypass
    Wysoka · 8.2 CVE-2025-43585 >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  10. Magneto contains stored XSS vulnerability
    Krytyczna · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  11. Improper Authorization vulnerability in Magento and Adobe Commerce
    Krytyczna · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Magento stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Path Traversal
    Wysoka · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Adobe Commerce Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Improper Access Control vulnerability
    Wysoka · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  23. Magento Open Source Improper Authorization vulnerability
    Wysoka · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Open Source Improper Access Control vulnerability
    Wysoka · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  25. Magento Stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 7.6 CVE-2024-39403 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.1 CVE-2024-39400 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento Path Traversal vulnerability
    Wysoka · 7.7 CVE-2024-39399 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento does not properly restrict excessive authentication attempts
    Wysoka · 7.4 CVE-2024-39398 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39402 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39401 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  31. Magento Open Source Improper Authentication vulnerability
    Krytyczna · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  34. Magento RCE,XSS and other vulnerabilities
    Krytyczna ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  35. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Krytyczna ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  36. Magento Open Source Security Advisory: Patch SUPEE-10975
    Krytyczna ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  37. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Krytyczna ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  38. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Krytyczna ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  39. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Krytyczna ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  40. Magento Open Source allows Improper Input Validation
    Wysoka · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  41. Magento Open Source allows OS Command Injection
    Wysoka · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
Pokaż więcej (20) Widać 41 z 152

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.