Sign in
Deutsch English Español Polski
Low

Magento does not properly protect credentials

  • Disclosed: 08.04.2025
  • Updated: 11.10.2026 12:17

Magento versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does not require user interaction.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package magento/community-edition >= 2.4.7-beta1, < 2.4.7-p5, >= 2.4.6-p1, < 2.4.6-p10, >= 2.4.5-p1, < 2.4.5-p12, < 2.4.4-p13, >= 2.4.8-beta1, < 2.4.8-beta2, = 2.4.5, = 2.4.4, = 2.4.6, = 2.4.7 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13, 2.4.8-beta2
Composer package magento/project-community-edition <= 2.0.2 no fix
Magento (core) magento/project-community-edition <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p5, >= 2.4.6-p1, < 2.4.6-p10, >= 2.4.5-p1, < 2.4.5-p12, < 2.4.4-p13, >= 2.4.8-beta1, < 2.4.8-beta2, = 2.4.5, = 2.4.4, = 2.4.6, = 2.4.7 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13, 2.4.8-beta2

References

CVSS score 2.7/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-522
Platform
Composer, Magento
Package
magento/community-edition, magento/project-community-edition
Disclosed
08.04.2025
Updated
11.10.2026 12:17

Sources and licenses

OSV / GitHub Advisory Database - GHSA-2r94-wm5v-4prx - CC BY 4.0

Vulnerability history: magento/project-community-edition

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
11.2019 10.2025
Without a fix
160
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 48
  • Medium 77
  • Low 12

Disclosures per year

Severity:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    High · 8.1 CVE-2025-54264 <= 2.0.2 no fix
  2. Magento provides incorrect authorization through a security feature bypass
    High · 8.1 CVE-2025-54263 <= 2.0.2 no fix
  3. Magento Community Edition Improper Input Validation vulnerability
    Critical · 9.1 Exploited in attacks CVE-2025-54236 <= 2.0.2 no fix
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    High · 8.1 CVE-2025-49555 <= 2.0.2 no fix
  5. Magento vulnerable to denial of service
    High · 7.5 CVE-2025-49554 <= 2.0.2 no fix
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    High · 7.5 CVE-2025-49556 <= 2.0.2 no fix
  7. Magento Cross-site Scripting vulnerability
    High · 8.7 CVE-2025-49557 <= 2.0.2 no fix
  8. Magento Improper Authorization leading to security feature bypass
    High · 8.2 CVE-2025-43585 <= 2.0.2 no fix
  9. Magento does not properly protect credentials this entry
    Low · 2.7 CVE-2025-27192 <= 2.0.2 no fix
  10. Improper Authorization vulnerability in Magento and Adobe Commerce
    Critical · 9.1 CVE-2025-24434 <= 2.0.2 no fix
  11. Magento stored Cross-Site Scripting (XSS) vulnerability
    High · 8.7 CVE-2025-24438 <= 2.0.2 no fix
  12. Adobe Commerce Path Traversal
    High · 7.5 CVE-2025-24406 <= 2.0.2 no fix
  13. Adobe Commerce Improper Authorization vulnerability
    High · 8.2 CVE-2025-24409 <= 2.0.2 no fix
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24417 <= 2.0.2 no fix
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24416 <= 2.0.2 no fix
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24415 <= 2.0.2 no fix
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24414 <= 2.0.2 no fix
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24413 <= 2.0.2 no fix
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24412 <= 2.0.2 no fix
  20. Magento Improper Access Control vulnerability
    High · 8.1 CVE-2025-24411 <= 2.0.2 no fix
  21. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24410 <= 2.0.2 no fix
  22. Magento Stored Cross-Site Scripting (XSS) vulnerability
    High · 7.6 CVE-2024-39403 <= 2.0.2 no fix
  23. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    High · 8.1 CVE-2024-39400 <= 2.0.2 no fix
  24. Magento Path Traversal vulnerability
    High · 7.7 CVE-2024-39399 <= 2.0.2 no fix
  25. Magento does not properly restrict excessive authentication attempts
    High · 7.4 CVE-2024-39398 <= 2.0.2 no fix
  26. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39402 <= 2.0.2 no fix
  27. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39401 <= 2.0.2 no fix
  28. Magento Open Source allows Improper Input Validation
    High · 9.0 CVE-2024-20758 <= 2.0.2 no fix
  29. Magento Open Source allows OS Command Injection
    High · 9.1 CVE-2024-20720 <= 2.0.2 no fix
  30. Magento Open Source allows Cross-Site Scripting (XSS)
    High · 9.1 CVE-2024-20719 <= 2.0.2 no fix
  31. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Critical · 9.1 CVE-2021-36021 <= 2.0.2 no fix
  32. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Critical · 9.1 CVE-2021-36036 <= 2.0.2 no fix
  33. Magento XML Injection vulnerability in the Widgets Update Layout
    Critical · 9.1 CVE-2021-36023 <= 2.0.2 no fix
  34. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-38208 <= 2.0.2 no fix
  35. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-29297 <= 2.0.2 no fix
  36. Magento Open Source allows XML Injection
    High · 7.5 CVE-2023-22247 <= 2.0.2 no fix
  37. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    High · 10.0 CVE-2022-35698 <= 2.0.2 no fix
  38. Magento XML Injection vulnerability in the 'City' field
    High CVE-2021-36020 <= 2.0.2 no fix
  39. Magento XML Injection vulnerability in the Widgets Update Layout
    High · 7.2 CVE-2021-36022 <= 2.0.2 no fix
  40. Magento is affected by an improper input validation vulnerability
    High · 8.8 CVE-2021-36032 <= 2.0.2 no fix
  41. Magento has an XML Injection vulnerability
    Critical CVE-2021-36028 <= 2.0.2 no fix
  42. Magento is affected by an improper input validation vulnerability while saving a customer's details
    Critical · 9.1 CVE-2021-36025 <= 2.0.2 no fix
  43. Magento is affected by an os command injection via the Data collection endpoint
    High · 7.2 CVE-2021-36024 <= 2.0.2 no fix
  44. Magento XML Injection vulnerability in the Widgets Module
    Critical CVE-2021-36033 <= 2.0.2 no fix
  45. Magento allows attackers to alter the price of items
    High CVE-2021-36030 <= 2.0.2 no fix
  46. Magento improper authorization vulnerability
    High · 7.2 CVE-2021-36029 <= 2.0.2 no fix
  47. Magento Path Traversal vulnerability via the `theme[preview_image]` parameter
    High CVE-2021-36031 <= 2.0.2 no fix
  48. Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension
    High · 8.0 CVE-2021-36043 <= 2.0.2 no fix
  49. Magento executes code via the API File Option Upload Extension
    Critical · 9.1 CVE-2021-36042 <= 2.0.2 no fix
  50. Magento vulnerable to file upload attack
    High · 7.2 CVE-2021-36041 <= 2.0.2 no fix
  51. Magento affected by remote code execution via a file upload
    High · 7.2 CVE-2021-36034 <= 2.0.2 no fix
  52. Magento has a file extension restrictions bypass
    Critical · 9.1 CVE-2021-36040 <= 2.0.2 no fix
  53. Magento affected by a server-side denial-of-service using a GraphQL field
    High · 7.5 CVE-2021-36044 <= 2.0.2 no fix
  54. Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats
    High · 7.5 CVE-2021-28583 <= 2.0.2 no fix
  55. Magento stored cross-site scripting (XSS) in the customer address upload feature
    High · 8.1 CVE-2021-21030 <= 2.0.2 no fix
  56. Magento vulnerable to a file upload restriction bypass
    Critical · 9.1 CVE-2021-21014 <= 2.0.2 no fix
  57. Magento XPath Injection
    Critical · 9.1 CVE-2021-21025 <= 2.0.2 no fix
  58. Magento OS command injection via the WebAPI
    Critical · 9.1 CVE-2021-21016 <= 2.0.2 no fix
  59. Magento 2 Community Edition RCE via Unsafe File Upload
    Critical · 9.1 CVE-2020-24407 <= 2.0.2 no fix
  60. Magento DOM-based Cross-site scripting vulnerability
    Critical · 9.6 CVE-2020-9691 <= 2.0.2 no fix
Show more (13) Showing 60 of 73

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.