Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

CRITICALGHSA-5gmh-85x8-5cx7 · Published 15/05/2024 · updated 29/11/2024

In short

GHSA-5gmh-85x8-5cx7 is a CRITICAL vulnerability affecting magento/community-edition.
Fix: update to 2.1.14, 2.2.5 or later.

Package	Affected versions	Patched versions
magento/community-edition Packagist	`≥ 2.1, < 2.1.14≥ 2.2, < 2.2.5`	`2.1.142.2.5`

Description

Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

References

FriendsOfPHP/security-advisories · WEB
magento/magento2 · PACKAGE
web.archive.org/web/20210802091126/https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update · WEB

More vulnerabilities in magento/community-edition

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free