| Package | Affected versions | Patched versions |
|---|---|---|
| magento/community-edition | ≥ 2.2.0, < 2.2.10≥ 2.3.0, < 2.3.2-p1 | 2.2.102.3.2-p1 |
| magento | = 2.3.2≥ 2.2.0, < 2.2.10≥ 2.3.0, < 2.3.2 | 2.2.102.3.2 |
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free