Zaloguj się
Deutsch English Español Polski
Krytyczna

Magento Open Source Security Advisory: Patch SUPEE-10975

  • Ujawniono: 15.05.2024
  • Aktualizacja: 11.10.2026 11:18

Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated:

  • PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication
  • MAG-23: M1 Credit Card Storage Capability
  • PRODSECBUG-2149: Authenticated RCE using customer import
  • PRODSECBUG-2159: API Based RCE Vulnerability
  • PRODSECBUG-2156: RCE Via Unauthorized Upload
  • PRODSECBUG-2155: Authenticated RCE using dataflow
  • PRODSECBUG-2053: Prevents XSS in Newsletter Template
  • PRODSECBUG-2142: XSS in CMS Preview
  • PRODSECBUG-1860: Admin Account XSS Attack Cessation via Filename
  • PRODSECBUG-2119: EE Patch to include names in templates
  • PRODSECBUG-2129: XSS in Google Analytics Vulnerability
  • PRODSECBUG-2019: Merchant Wishlist Security Strengthening
  • PRODSECBUG-2104: Send to a Friend Vulnerability
  • PRODSECBUG-2125: CSRF on deletion of Blocks Vulnerability
  • PRODSECBUG-2088: CSRF Vulnerability related to Customer Group Deletion
  • PRODSECBUG-2140: CSRF on deletion of Site Map
  • PRODSECBUG-2108: Outdated jQuery causing PCI scanning failures
  • MAG-12, MAG-2: Encryption Keys Stored in Plain Text
  • PRODSECBUG-2141: Unauthorized Admin Panel Bypass

Patching and Upgrading:

Patches and upgrades are available for the following Magento versions:

Magento Commerce 1.9.0.0-1.14.4.0: Apply SUPEE-10975 or upgrade to Magento Commerce 1.14.4.0. Magento Open Source 1.5.0.0-1.9.4.0: Apply SUPEE-10975 or upgrade to Magento Open Source 1.9.4.0.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka Composer magento/community-edition >= 1.9.0.0, < 1.14.4.0 1.14.4.0
Magento (rdzeń) magento/community-edition >= 1.9.0.0, < 1.14.4.0 1.14.4.0

Odnośniki

Ocena CVSS -
Słabość (CWE)
-
Platforma
Composer, Magento
Paczka
magento/community-edition
Ujawniono
15.05.2024
Aktualizacja
11.10.2026 11:18

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-cv25-3pxr-4q7x - CC BY 4.0

Historia podatności: magento/community-edition

Wszystkie opisane podatności tej paczki (Magento (rdzeń)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (360) w archiwum
Wszystkich wpisów
360
Pierwsza → ostatnia
11.2019 10.2025
Bez poprawki
3
Wykorzystywana w atakach
3

Rozkład istotności

  • Krytyczna 47
  • Wysoka 104
  • Średnia 192
  • Niska 17

Ujawnienia w latach

Istotność:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Wysoka · 8.1 CVE-2025-54264 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  2. Magento provides incorrect authorization through a security feature bypass
    Wysoka · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, <= 2.0.2, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento Community Edition Improper Input Validation vulnerability
    Krytyczna · 9.1 Wykorzystywana w atakach CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 brak poprawki
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Wysoka · 8.1 CVE-2025-49555 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  5. Magento vulnerable to denial of service
    Wysoka · 7.5 CVE-2025-49554 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    Wysoka · 7.5 CVE-2025-49556 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento Cross-site Scripting vulnerability
    Wysoka · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, <= 2.0.2, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  8. Magento Improper Authorization leading to security feature bypass
    Wysoka · 8.2 CVE-2025-43585 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  9. Magneto contains stored XSS vulnerability
    Krytyczna · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  10. Improper Authorization vulnerability in Magento and Adobe Commerce
    Krytyczna · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  11. Magento stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Adobe Commerce Path Traversal
    Wysoka · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Improper Access Control vulnerability
    Wysoka · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Open Source Improper Authorization vulnerability
    Wysoka · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  23. Magento Open Source Improper Access Control vulnerability
    Wysoka · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 7.6 CVE-2024-39403 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  25. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.1 CVE-2024-39400 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento Path Traversal vulnerability
    Wysoka · 7.7 CVE-2024-39399 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento does not properly restrict excessive authentication attempts
    Wysoka · 7.4 CVE-2024-39398 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39402 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39401 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento Open Source Improper Authentication vulnerability
    Krytyczna · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  31. Magento Open Source Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento RCE,XSS and other vulnerabilities
    Krytyczna ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  34. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Krytyczna ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  35. Magento Open Source Security Advisory: Patch SUPEE-10975 ten wpis
    Krytyczna ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  36. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Krytyczna ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  37. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Krytyczna ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  38. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Krytyczna ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  39. Magento Open Source allows Improper Input Validation
    Wysoka · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  40. Magento Open Source allows OS Command Injection
    Wysoka · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
Pokaż więcej (20) Widać 40 z 151

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.