Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities · GHSA-5gmh-85x8-5cx7 · GitHub Advisory Database · GitHub

Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

Critical severity GitHub Reviewed Published May 15, 2024 to the GitHub Advisory Database

Package

magento/community-edition (Composer)

Affected versions

>= 2.1, < 2.1.14

>= 2.2, < 2.2.5

Patched versions

2.1.14

2.2.5

Description

Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

References

Published to the GitHub Advisory Database May 15, 2024

Reviewed May 15, 2024