Magento Archives - Side 2 af 2

The blocks in the sales_order_print.xml layout in the Magento_Sales module had never been set to private or non-cacheable. Therefore, if the full-page cache had enabled, and a signed-in user visits the print order page. Any other signed in user could visit that url and see their detailed order information.

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5

[APPSEC-2058] CSRF Mass Deletion of Products

Skrevet den 17. april 201920. november 2024 af i Magento

Allows a deletion of single or all store products. When a POST request that performs the deletion of products was switched to GET, the lack of form_key parameter that serves as a CSRF token was completely ignored, allowing the request to be used in Cross-Site Request Forgery attacks+

Part of Magento 2.1.15, 2.2.6

This vulnerability affects the following application versions:

Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5

[APPSEC-2059] CSRF Mass Deletion of Customers

Skrevet den 2. april 201920. november 2024 af i Magento

Allowed a deletion of single or all store customers. When a POST request that performed the deletion of customers was switched to GET, the lack of form_key parameter that served as a CSRF token was completely ignored, allowing the request to be used in Cross-Site Request Forgery attacks.

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.2.4
Magento 2.2.5

[APPSEC-2006] Admin Stored XSS via Enterprise Logging

Skrevet den 1. april 201920. november 2024 af i Magento

The `Enterprise_Logging` extension logs requested data when save events were triggered on the website. This information was displayed to administrators with limited privileges that could view the audit log. Although these saved values were escaped before output, the keys were not, which made it possible to insert cross-site scripting (XSS) on this page.

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5

[APPSEC-2045] PHP Files was possible tou uploade Via Custom Options

Skrevet den 1. april 201920. november 2024 af i Magento

An attacker with limited admin privileges could create a new product (or update an existing product) to allow upload of PHP script via custom option, order that product (through the admin panel the total could be adjusted to $0.00) and uploaded an arbitrary PHP script as a custom option and then executed the PHP script via the browser to achieve RCE (again, in e.g. an nginx environment).

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5

[APPSEC-2092] CSRF on Changing of orders status

Skrevet den 1. april 201920. november 2024 af i Magento

Cross site request forgery vulnerability that could change the status of orders. The attack was possible if an admin had the Add Secret Key to URLs disabled.

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5

[APPSEC-1502/1802/1773/1853] Combined patch to improve security for customer registration through frontend – 2

Skrevet den 1. april 201920. november 2024 af i Magento

APPSEC-1502: Stored XSS – Add new group in Attribute set name

APPSEC-1802: Customer registration through frontend did not have anti-CSRF protection

APPSEC-1773: Injection on Page leading to DoS

APPSEC-1853: CSRF + Stored Cross Site Scripting in newsletter template

Part of patch Magento 2.0.16 and 2.1.9 Security Update

Note:

It can be the case that you will receive a message that the files are patched for the 2 below shown files for versions “2.1.12, 2.1.11, 2.1.10, 2.1.9”. As stated in this message the security fix is coming from 2.1.9. What we had to do is move code from a newly introduced file to “AbstractBlock.php”. This is code wise the most logical place. It it turns out that the hashes of version range 2.1.12-2.1.5 is the same for “AbstractBlock.php”. Therefor we automatically have to patch the entire range. This is currently due to the limitations of our system.

vendor/magento/framework/View/Element/AbstractBlock.php

vendor/magento/framework/Escaper.php

This vulnerability affects the following application versions:

Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12

[APPSEC-2027] Multiple CSRF (Website, Store, Store View deletion)

Skrevet den 1. april 201920. november 2024 af i Magento

Multiple CSRF attack had occurred in the website, web stores and also in the view deletion options.

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.1.18
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5

[PRODSECBUG-2198] SQL Injection vulnerability through an unauthenticated user

Skrevet den 29. marts 201918. oktober 2025 af i Magento

An unauthenticated user could execute arbitrary code through an SQL injection vulnerability, which caused sensitive data leakage.

Part of update Magento 2.3.1, 2.2.8 and 2.1.17 Security Update

This vulnerability affects the following application versions:

Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5
Magento 2.2.6
Magento 2.2.7
Magento 2.3.0

[APPSEC-2048] SQL Injection through API

Skrevet den 21. marts 201920. november 2024 af i Magento

A authenticated API user could perform a SQL Injection by exploiting several API endpoints.

Part of security release MAGENTO 2.2.5 AND 2.1.14 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4

[APPSEC-2054] Remote Code Execution (RCE) via product import

Skrevet den 21. marts 201920. november 2024 af i Magento

Importing products were not properly sanitized that could expose to code execution.

Part of security release MAGENTO 2.2.5 AND 2.1.14 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4

[APPSEC-2025] Arbitrary File Delete via Product Image

Skrevet den 18. marts 201920. november 2024 af i Magento

An administrator user could delete arbitrary files from the server by sending modified data to the WYSIWYG admin component.

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4

[APPSEC-1936] Customer password recoverable from the database

Skrevet den 12. februar 201920. november 2024 af i Magento

Magento customer password recoverable from the database `sales_flat_quote` table. A malicious user could use a brute-force attack to recover the `global/secret/key` from the `app/etc/local.xml` file, upload a file, and then decrypt it.

Part of patch SUPEE-10888

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8
Magento 1.9.3.9

[APPSEC-1730] Downloader did not force to use HTTPS

Skrevet den 12. februar 201920. november 2024 af i Magento

Downloader now will only use HTTPS connections.

Part of patch SUPEE-10888

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8
Magento 1.9.3.9

[APPSEC-1933] Moxieplayer Redirect

Skrevet den 12. februar 201920. november 2024 af i Magento

A Moxieplayer redirect allowed an open redirect to any site in an exploitable manner.

Part of patch SUPEE-10888

This vulnerability affects the following application versions:

Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8
Magento 1.9.3.9

[APPSEC-1901] Local file inclusion in customer view

Skrevet den 4. februar 201920. november 2024 af i Magento

An administrator with limited privileges could read arbitrary files from the file system.

Part of security update MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1272] No CSRF Protection in Order Printing

Skrevet den 4. februar 201920. november 2024 af i Magento

A user could craft a URL that forces another user to open the Print Order view.

Part of security update MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1906] Cross-site Scripting in System Configuration

Skrevet den 4. februar 201920. november 2024 af i Magento

An administrator with system configuration privileges had covertly added JavaScript to the Magento store front.

Part of security release MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1889] CSRF Protection Bypass

Skrevet den 30. januar 201920. november 2024 af i Magento

An administrator with limited privileges could craft a cross-site request to perform requests on behalf of another administrator.

Part of security update MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.1.18
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2

[APPSEC-1905] Cross-site Scripting in detailed rating

Skrevet den 30. januar 201920. november 2024 af i Magento

An administrator with limited privileges could have had inserted script into the detailed rating, which could potentially result in stored cross-site scripting that affects other administrators.

Part of security update MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.1
Magento 2.2.2

[APPSEC-1937] Information Exposure

Skrevet den 30. januar 201920. november 2024 af i Magento

Weak protection checking could potentially lead to privilege escalation or information disclosure.

Part of update MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.1.18
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1995] Cross-site Scripting in Downloadable Products – 2

Skrevet den 30. januar 201920. november 2024 af i Magento

An administrator with limited privileges could insert arbitrary code into product fields, which could potentially lead to a stored cross-site scripting attack.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1987] Reflective cross-site scripting (XSS) through filter manipulation

Skrevet den 6. december 201820. november 2024 af i Magento

Arbitrary JavaScript could be triggered on the sales order page by manipulating one of the URL parameters.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1998] Cross-site Scripting in product attributes

Skrevet den 28. november 201820. november 2024 af i Magento

An administrator with limited privileges could embed cross-site scripting elements in product attributes, which could potentially lead to a cross-site scripting attack.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2

[APPSEC-1591] Stored XSS on product thumbnail

Skrevet den 27. november 201820. november 2024 af i Magento

A Magento administrator with limited privileges could add new products that could contain a malicious script in the product’s thumbnail.

Part of patch 2.0.16, 2.1.9

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1882] The cron.php file could leak database credentials

Skrevet den 27. november 201820. november 2024 af i Magento

The cron.php file could leak database credentials if it is not able to establish a connection to the database.

Part of Patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1928] Stored XSS in Downloadable Product Links title – frontend

Skrevet den 27. november 201820. november 2024 af i Magento

An administrator user with access to edit products could insert a malicious script into downloadable products. The malicious script could be triggered on the front-end and admin area.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-2027] CSRF was possible against web sites, stores, and store views

Skrevet den 27. november 201820. november 2024 af i Magento

Multiple CSRF vulnerabilities allowed for deleting websites, stores or store views.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1935] Cross-site Scripting leading to Denial-of-Service

Skrevet den 27. november 201820. november 2024 af i Magento

A user could insert script in their address field, which could potentially introduce a denial-of -service vulnerability. External reference: Fortiguard FG-VD-17-116.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2

[APPSEC-1951] JavaScript execution in the administrator panel

Skrevet den 27. november 201820. november 2024 af i Magento

A user could insert a script in storefront field that could lead to arbitrary JavaScript code execution in the context of the administrator panel.

Part of patch: 2.2.3, 2.1.12, 2.0.18

This vulnerability affects the following application versions:

Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1993] IP spoofing

Skrevet den 22. november 201820. november 2024 af i Magento

A vulnerability was found that had permitted the IP spoofing of a client’s address, which allowed the potential bypassing of any security features that rely on identifying a client by their IP source.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1929] Path traversal in image upload

Skrevet den 21. november 201820. november 2024 af i Magento

An administrator with limited privileges could insert a file in the file system using the WYSIWYG image upload process.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2
Magento 2.2.3
Magento 2.2.4
Magento 2.2.5
Magento 2.2.6
Magento 2.2.7
Magento 2.2.8
Magento 2.2.9
Magento 2.2.10
Magento 2.2.11
Magento 2.3.0
Magento 2.3.1
Magento 2.3.2
Magento 2.3.2-p1
Magento 2.3.2-p2
Magento 2.3.3
Magento 2.3.3-p1
Magento 2.3.4
Magento 2.3.4-p2
Magento 2.3.5
Magento 2.3.5-p1

[APPSEC-1986] Local file inclusion in import history

Skrevet den 21. november 201820. november 2024 af i Magento

An administrator with limited privileges can delete critical system control files to subsequently gain privilege escalation through the Import History feature.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2

[APPSEC-1972/APPSEC-2103] Admin password change did not force the logout of the admin user

Skrevet den 21. november 201820. november 2024 af i Magento

Password changes initiated from the admin panel did not force a logout.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-2005] Persistent Cross-Site Scripting (XSS) injection in configuration table

Skrevet den 21. november 201820. november 2024 af i Magento

A user with access to an admin account that includes ACL permissions to save the shipping methods section of the configuration table could insert cross-site scripting into the database that was subsequently output on every section of the `System > Configuration` table.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1861] PHP Object Injection in product entries leading to remote code execution

Skrevet den 21. november 201820. november 2024 af i Magento

An administrator with limited privileges could insert injectable code in promo fields, creating an opportunity for arbitrary remote code execution.

Part of patch MAGENTO 2.2.1, 2.1.10 AND 2.0.17 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12

[APPSEC-1973] Cross-site Scripting in newsletter template

Skrevet den 21. november 201820. november 2024 af i Magento

An administrator with limited privileges could embed cross-site scripting elements in the newsletter template, which could potentially lead to a stored cross-site scripting attack.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.1
Magento 2.2.2

[APPSEC-1800] Remote Code Execution vulnerability in CMS and layouts

Skrevet den 20. november 201820. november 2024 af i Magento

A Magento administrator with limited privileges could introduce malicious code when creating a new CMS Page, which could result in arbitrary remote code execution.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1896] Possible XSS in admin order view using order code label

Skrevet den 20. november 201820. november 2024 af i Magento

A Magento administrator with limited privileges could insert executable code in the order view through the order code label.

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1819] Customer login authenticates two different sessions

Skrevet den 20. november 201820. november 2024 af i Magento

Magento had not correctly set concurrent sessions to expire. A customer could log out under the mistaken assumption that their sessions had expired, but later, an attacker could access the account through one of the unexpired sessions.

Part of patch: MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1673] Stored XSS using SVG images in favicon

Skrevet den 5. november 201820. november 2024 af i Magento

A Magento administrator with limited privileges could add new SVG images that contain injected code.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1887] Arbitrary file disclose

Skrevet den 5. november 201820. november 2024 af i Magento

A Magento administrator with limited privileges could exploit a vulnerability in the theme creation function to arbitrarily disclose and delete system files of a Magento installation.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1755] Anti-CSRF form_key was not changed after login

Skrevet den 2. november 201820. november 2024 af i Magento

The anti-CSRF form_key was not changed after a user logs in.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1769 ] Overwrite a relative path in sitemap

Skrevet den 2. november 201820. november 2024 af i Magento

A Magento administrator with limited privileges could use the sitemap generation tool to arbitrarily overwrite sensitive files.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1577] Stored XSS in integration activation

Skrevet den 1. november 201820. november 2024 af i Magento

A Magento administrator could inject code in the integration activation.

Part of security patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1567] Order history disclosure

Skrevet den 30. oktober 201820. november 2024 af i Magento

If an anonymous attacker was given generic order information, he could generate a cookie collision and obtain order information.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1495/1510/1535] Access control lists not checked properly in some pages

Skrevet den 29. oktober 201820. november 2024 af i Magento

Combined patch, because the changes are the same.

[APPSEC-1495] Any user can interact with the sales order function despite not being authorized

[APPSEC-1510] Any admin user can upload favicon Icon

[APPSEC-1535] Access control lists not validated when using quick edit mode in tables

Part of patch 2.0.16, 2.1.9

This vulnerability affects the following application versions:

Magento 0.42.0-beta4
Magento 0.42.0-beta5
Magento 0.42.0-beta6
Magento 0.42.0-beta7
Magento 0.42.0-beta8
Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12

[APPSEC-1701] API token did not correctly expire

Skrevet den 29. oktober 201820. november 2024 af i Magento

Customer and admin tokens did not expire correctly, which allowed for the potential re-use of a cookie by an attacker.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12

[APPSEC-1709] Customer email enumeration through frontend login

Skrevet den 24. oktober 201820. november 2024 af i Magento

The account lockout mechanism could leak the Magento site’s contact e-mail.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1588] Order item custom option disclosure

Skrevet den 24. oktober 201820. november 2024 af i Magento

An attacker could craft a URL request on a Magento site during checkout and retrieve information about past orders.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11

[APPSEC-1775] Stored Cross-Site scripting in email template bypass

Skrevet den 17. oktober 201820. november 2024 af i Magento

A Magento administrator with limited privileges could insert malicious code in email templates.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1630] Anonymous users can view upgrade progress updates

Skrevet den 17. oktober 201820. november 2024 af i Magento

An anonymous user could visit an internal URL and see the status of a Magento upgrade.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta7
Magento 0.42.0-beta8
Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1897] Fix WSDL based patching to work with SOAP V1

Skrevet den 11. oktober 201820. november 2024 af i Magento

This had addressed an issue affecting a small number of customers to enable two prior patches to handle SOAP v1 interactions in WSDL.

Part of patch: 1.9.3.7, 1.14.3.7, SUPEE-10415

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6

[APPSEC-1830] PHP object Injection in product attributes leading to remote code execution

Skrevet den 8. oktober 201820. november 2024 af i Magento

An administrator with limited privileges could insert injectable code in product attributes, potentially leading to arbitrary remote code execution.

Part of patch MAGENTO 2.2.1, 2.1.10 AND 2.0.17 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.1.18
Magento 2.2.0

[APPSEC-1914] Stored XSS in CMS page area

Skrevet den 1. oktober 201820. november 2024 af i Magento

An administrator with limited privileges could create a page within the Content Management System (CMS) with an embedded cross-site scripting attack.

Part of patch SUPEE-10415

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6

[APPSEC-1325] Stored XSS in billing agreements

Skrevet den 1. oktober 201820. november 2024 af i Magento

An administrator with limited privileges could create billing agreements with embedded cross-site scripting elements that could subsequently lead to a stored cross-site scripting attack.

Part of patch SUPEE-10415

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9

[APPSEC-1967] Password change session management

Skrevet den 1. oktober 201820. november 2024 af i Magento

Magento did not previously terminate existing sessions when the currently logged-in user changed his or her password.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2

[APPSEC-1930] PHP Object injection in widgets could lead to remote code execution

Skrevet den 26. september 201820. november 2024 af i Magento

An administrator with limited privileges could have inserted a widget block containing malicious code, creating an opportunity for arbitrary remote code execution.

Part of patch MAGENTO 2.2.1, 2.1.10 AND 2.0.17 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta4
Magento 0.42.0-beta5
Magento 0.42.0-beta6
Magento 0.42.0-beta7
Magento 0.42.0-beta8
Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6

[APPSEC-1928] Cross-site scripting in downloadable product link

Skrevet den 25. september 201820. november 2024 af i Magento

An administrator with limited privileges could insert script in the downloadable product link title field, which could subsequently lead to a stored cross-site scripting attack.

Part of patch Magento 2.0.18, 2.1.12, 2.2.3

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1910] Local File Inclusion (LFI) in import history

Skrevet den 24. september 201820. november 2024 af i Magento

An administrator with limited privileges was able to delete critical system control files to subsequently gain privilege escalation through the import history section.

Part of patch MAGENTO 2.2.1, 2.1.10 AND 2.0.17 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6

[APPSEC-1947/APPSEC-1945] Cross-site scripting in RMA functionality

Skrevet den 20. september 201820. november 2024 af i Magento

A user could insert script in the RMA SKU field, which could potentially result in a stored cross-site scripting attack.

Part of patch: 2.0.18, 2.1.12, 2.2.3

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1900] Remote code execution by leveraging 1st stage unsanitized form input

Skrevet den 18. september 201820. november 2024 af i Magento

An administrator with limited privileges could create a store website that could accept and run arbitrary remote code execution.

Part of patch MAGENTO 2.2.1, 2.1.10 AND 2.0.17 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.1.18
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6

[APPSEC-1931] PHP Object Injection in Zend framework leading to arbitrary file deletion

Skrevet den 18. september 201820. november 2024 af i Magento

An administrator with limited privileges could inject malicious code that could cause sensitive files to be deleted. He could then launch a second stage payload that would lead to arbitrary remote code execution.

Part of patch MAGENTO 2.2.1, 2.1.10 AND 2.0.17 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta11
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.1.12
Magento 2.1.13
Magento 2.1.14
Magento 2.1.15
Magento 2.1.16
Magento 2.1.17
Magento 2.1.18
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6

[APPSEC-1850] Arbitrary file delete

Skrevet den 13. september 201820. november 2024 af i Magento

A Magento administrator with limited privileges could use the delete files module to upload and delete arbitrary files.

Part of patch MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1545] Stored XSS through customer group name in admin panel

Skrevet den 13. september 201820. november 2024 af i Magento

A Magento administrator could inject scriptable code into customer fields, which could result in an XSS attack.

Part of patch 2.0.16, 2.1.9

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1873/1979/1980] Cross-site scripting in site settings

Skrevet den 13. september 201820. november 2024 af i Magento

An administrator with limited privileges could embed cross-site scripting elements in the website name/store view name setting, which could potentially lead to a stored cross-site scripting attack.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1889] Cross-Site request forgery protection bypass

Skrevet den 13. september 201820. november 2024 af i Magento

An administrator with limited privileges could craft a cross-site request to perform requests on behalf of another administrator.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1891] Cross-site scripting in admin shipment tracking

Skrevet den 23. august 201820. november 2024 af i Magento

An administrator with limited privileges could insert script into the shipment tracking, which could potentially result in stored cross-site scripting that affects other administrators.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1944] Cross-site scripting in date fields

Skrevet den 22. august 201820. november 2024 af i Magento

An administrator with limited privileges could insert script into the private sales events and invitations fields, which could subsequently lead to a stored cross-site scripting attack.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1916] Cross-site scripting in attribute group name

Skrevet den 15. august 201820. november 2024 af i Magento

An administrator with limited privileges could insert script in the attribute group name field, which could potentially result in stored cross-site scripting that affects other administrators.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1878/1890] Cross-site scripting in CMS hierarchy

Skrevet den 14. august 201820. november 2024 af i Magento

An administrator with limited privileges could insert script into the CMS hierarchy, which could potentially result in a stored cross-site scripting that affects other administrators.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.0-RC1.8
Magento 2.2.1
Magento 2.2.2

[APPSEC-1938] Remote Code Execution – additional fix not included in SUPEE-9652

Skrevet den 13. august 201820. november 2024 af i Magento

A user could insert information in a return path, thereby storing information on the file system that could lead to Remote Code Execution (RCE).

Part of patch SUPEE-9652

This vulnerability affects the following application versions:

Magento 1.9.3.7

[APPSEC-2001] Authenticated remote code execution (RCE) using custom layout XML

Skrevet den 13. august 201820. november 2024 af i Magento

Admin users with permission to manage products could use custom layout XML to copy any file to any location.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-2034] XSS in admin create order configure product via compatible file extensions

Skrevet den 13. august 201820. november 2024 af i Magento

An administrator user coudl inject a malicious script into the file option type when creating a new product with a configurable option of type file. This script would then be executed when a user clicks Configure next to the product when creating an order.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1026] Session Management (not included in SUPEE-10570v2)

Skrevet den 13. august 201820. november 2024 af i Magento

Active sessions persist after a password change.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1913] Remote code execution through config manipulation

Skrevet den 9. august 201820. november 2024 af i Magento

An administrator with limited privileges could inject a malformed configuration bypass leading to a file redirection that could be leveraged in to arbitrary remote code execution.

Part of patch SUPEE-10415

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6

[APPSEC-1994] CSRF in store backups

Skrevet den 8. august 201820. november 2024 af i Magento

An administrator could be tricked into performing a system backup by an attacker who had crafted a targeted Cross-Site Request forgery (CSRF) attack.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.0-RC1.1
Magento 2.2.0-RC1.2
Magento 2.2.0-RC1.3
Magento 2.2.0-RC1.4
Magento 2.2.0-RC1.5
Magento 2.2.0-RC1.6
Magento 2.2.1
Magento 2.2.2

[APPSEC-1945] Cross-site scripting in product SKU

Skrevet den 7. august 201820. november 2024 af i Magento

An administrator with limited privileges could insert script in the RMA SKU field, which could potentially result in a stored cross-site scripting attack.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1876] Cross-site scripting (XSS) in Admin Bundle Product Bundle Items Tab through Product SKU

Skrevet den 6. august 201820. november 2024 af i Magento

Scripts in product SKUs were evaluated and executed when a user views the Bundle Items tab for a bundled product.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1908/1948] – Cross-site Scripting in custom variable

Skrevet den 23. juli 201820. november 2024 af i Magento

An administrator with limited privileges could insert script in the custom variables name field, which could potentially result in stored cross-site scripting that affected other administrators.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2

[APPSEC-1964] – Remote Code Execution by (semi-)arbitrary file deletion for admin users with access to Import

Skrevet den 23. juli 201820. november 2024 af i Magento

An administrator with Import permissions could import an XML file that could potentially provide an opportunity for Remote Code Execution (RCE).

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1973] Cross-site Scripting in Newsletter Template

Skrevet den 23. juli 201820. november 2024 af i Magento

An administrator with limited privileges could embed cross-site scripting elements in the Newsletter template, which could potentially lead to a stored cross-site scripting attack.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1995] Cross-site Scripting in Downloadable Products

Skrevet den 23. juli 201820. november 2024 af i Magento

An administrator with limited privileges could insert arbitrary code into product fields, which could potentially lead to a stored cross-site scripting attack.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1937] Insufficient privilege separation

Skrevet den 23. juli 201820. november 2024 af i Magento

Weak protection checking could potentially lead to privilege escalation or information disclosure.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-2000] Remote Code Execution in Staging Environment

Skrevet den 23. juli 201820. november 2024 af i Magento

An administrator with limited privileges could inject a malformed configuration bypass, which could potentially lead to a file redirection that could be leveraged for arbitrary remote code execution.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-2004] Cross-Site Scripting (XSS) through Remote File Inclusion

Skrevet den 23. juli 201820. november 2024 af i Magento

Users could use WYSIWYG directives to include valid remote images that have embedded malicious code that persists through image recreation.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-2006] Stored cross-site scripting (XSS) through the Enterprise Logging extension

Skrevet den 23. juli 201820. november 2024 af i Magento

The `Enterprise_Logging` extension logs request data when save events are triggered on the website. This information is displayed to administrators with limited privileges that can view the audit log. Although these saved values are escaped before output, the keys were not, which made it possible to insert cross-site scripting (XSS) on this page.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1928] Cross-site Scripting in downloadable product Link

Skrevet den 19. juli 201820. november 2024 af i Magento

An administrator with limited privileges could insert script in the downloadable product link title field, which could subsequently lead to a stored cross-site scripting attack.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1934] Systemic Cross-Site Request Forgery (CSRF) on the Checkout page

Skrevet den 19. juli 201820. november 2024 af i Magento

A user could inject a cross-site request forgery (CSRF) into a users cart on the Checkout page due to a missing CSRF token.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-2007] Authenticated SQL Injection when saving a category

Skrevet den 19. juli 201820. november 2024 af i Magento

By manipulating request data when saving a category, a user could insert a malicious string into the database that could be used in a subsequent request to perform SQL injection. This injected code could be used to trigger arbitrary (with the proviso they fit in the 255 char field) insert and update commands.

Part of patch SUPEE-10752

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8

[APPSEC-1932] Remote Code Execution Using XML Injection

Skrevet den 16. juli 201820. november 2024 af i Magento

An administrator with limited privileges could insert injectable XML into the layout table, which could create an opportunity for remote code execution.

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7

[APPSEC-1894] Remote Code Execution by leveraging unsafe unserialization

Skrevet den 20. juni 201820. november 2024 af i Magento

An administrator with limited privileges could insert injectable code in promo fields, creating an opportunity for arbitrary remote code execution. Part of SUPEE-10415.

This vulnerability affects the following application versions:

Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6

[APPSEC-1330] Unsanitized input led to denial of service

Skrevet den 20. juni 201820. november 2024 af i Magento

A site visitor could create an account where one of the parameters could have created a server denial-of-service. Part of SUPEE-10415.

This vulnerability affects the following application versions:

Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6

[APPSEC-1885] Stored XSS in Product Name field

Skrevet den 20. juni 201820. november 2024 af i Magento

An administrator with limited privileges could insert script in the product name field, potentially resulting in a stored cross-site scripting that affects other administrators. Part of SUPEE-10415.

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6

[APPSEC-1960] Path Traversal in static.php file

Skrevet den 31. maj 201820. november 2024 af i Magento

A user could gain file system write access using path traversal on the static.php file.

Part of patch MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8
Magento 2.1.9
Magento 2.1.10
Magento 2.1.11
Magento 2.2.0
Magento 2.2.0-rc2.0
Magento 2.2.0-rc2.1
Magento 2.2.0-rc2.2
Magento 2.2.0-rc2.3
Magento 2.2.0-rc3.0
Magento 2.2.1
Magento 2.2.2

[APPSEC-1493] CMS Page Title Stored XSS

Skrevet den 8. maj 201820. november 2024 af i Magento

A Magento administrator could inject executable scripts in non-executable areas, such as the page title.

Part of patch Magento 2.0.16 and 2.1.9 Security Update

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1494] AdminNotification Stored XSS

Skrevet den 26. marts 201820. november 2024 af i Magento

An attacker with the ability to launch a Man-in-the-middle attack on a network connection could inject code on the Magento Admin RSS feed.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1729] XSS in admin order view using order status label

Skrevet den 26. marts 201820. november 2024 af i Magento

An administrator could inject code in sales order records, which could result in an XSS attack on anyone that viewed the page.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1793] Potential file uploads solely protected by .htaccess

Skrevet den 26. marts 201820. november 2024 af i Magento

An attacker could target non-Apache installations (for example, Nginx) to upload executable scripts that could be used to stage additional exploitations.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1838] RSS session admin cookie could be used to gain administrator privileges

Skrevet den 26. marts 201820. november 2024 af i Magento

An attacker could use a low privilege RSS session cookie to escalate privileges and gain access to the Magento Admin Portal.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4

[APPSEC-1852] CSRF + Stored Cross Site Scripting (customer group)

Skrevet den 26. marts 201820. november 2024 af i Magento

A Magento administrator with limited privileges could exploit a vulnerability in the customer group to create a URL that could be used as part of CSRF attack.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1579] Customer Segment Delete Action uses GET instead of POST request

Skrevet den 26. marts 201820. november 2024 af i Magento

A Magento administrator could perform malicious actions through an inadequate security check of the form key in the customer segment page.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4

[APPSEC-1599] Admin login did not handle autocomplete feature correctly

Skrevet den 26. marts 201820. november 2024 af i Magento

Several fields in the Admin panel did not correctly handle autocomplete, which could result in a potential information leak when a browser tries to autocomplete the field.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.0.16
Magento 2.0.17
Magento 2.0.18
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6
Magento 2.1.7
Magento 2.1.8

[APPSEC-1688] Secure cookie check to prevent MITM not expiring user sessions

Skrevet den 26. marts 201820. november 2024 af i Magento

Magento did not properly validate session cookies, or caused them to expire, which potentially permits visitors to use expired cookies to interact with a store.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.0.14
Magento 2.0.15
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4

[APPSEC-1853] CSRF + Stored Cross Site Scripting in newsletter template

Skrevet den 26. marts 201820. november 2024 af i Magento

A Magento administrator with limited privileges could exploit a vulnerability in the newsletter template to create a URL that could be used as part of a CSRF attack.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4

[APPSEC-1757] Directory traversal in template configuration

Skrevet den 26. marts 201820. november 2024 af i Magento

An administrator with limited privileges could force Magento store notifications to include internal system files.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4

[APPSEC-1239-1] Stored XSS in Order Comments

Skrevet den 29. december 201720. november 2024 af i Magento

A user can append comments to an order using a specially crafted request that relies upon the PayFlow Pro payment module. Magento did not filter the request properly, which potentially resulted in JavaScript code being saved in database (see issue APPSEC-1240) and then executed server-side when the administrator tried to view the order. This attack could lead to a takeover of the administrator session or executing actions on behalf of administrator. Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[SUPEE 1533] An attacker could execute arbitrary code on Magento server

Skrevet den 11. december 201718. oktober 2025 af i Magento

2 Identified potential exploits were discovered that could:

1. Enable an attacker to execute arbitrary code on a Magento server.

2. Create files with a .csv extension, create writable directories, and change the permission of existing files to world-writable (777).

Creating files with a .csv extension could lead to executing files like php.csv (only under certain circumstances). The ability to run code with a .csv extension is dangerous itself and could be combined with other attacks; for example, targeting other software installed on the server.

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1

[APPSEC-921] Remote code execution

Skrevet den 11. december 2017 af i Magento

Authentication bypass uses special parameter that allows the execution of Admin action. The Admin action is vulnerable to SQL injection, which allows code to be inserted into the database and executed. As a result, the store can be fully compromised by creating counterfeit administrator accounts and/or installing malware on the server.

Part of patch SUPEE-5344

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0

[APPSEC-1305] Reflected XSS in backend coupon entry

Skrevet den 11. december 2017 af i Magento

When working with an order that contains items in the shopping cart, an administrator could enter JavaScript into the coupon code field of the Manage Shopping Cart page. This JavaScript could be executed later. While this feature was not an exploitable security issue, site audits may flag this issue, and it could cause security audits (such as PCI) to fail.

Part of SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1189] CSRF on removing item from Wishlist or Address Book

Skrevet den 11. december 2017 af i Magento

It was possible to create a phishing page that if visited by a store customer would delete the customer’s address or wishlist items.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1303] Magento 2 – Weak encryption keys when generated from Manage Encryption Keys page

Skrevet den 11. december 2017 af i Magento

Encryption keys that were generated in System > Manage Encryption Key were very weak; an attacker could easily recover them if he/she could access encrypted content. Encryption keys generated during installation are strong.

Part of patch MAGENTO 2.0.4 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2

[APPSEC-1239] Magento 2 – Stored XSS in Order Comments

Skrevet den 11. december 2017 af i Magento

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-924] Request forgery in Magento connect leads to code execution

Skrevet den 11. december 2017 af i Magento

Cross-site request forgery in Magento Connect Manager allowed an attacker to execute actions such as the installation of a remote module that leads to the execution of remote code. The attack required a Magento store administrator, while logged in to Magento Connect Manager, to click a link that was prepared by the attacker.

Part of patch SUPEE-6285

This vulnerability affects the following application versions:

Magento 1.1.5
Magento 1.1.6
Magento 1.1.7
Magento 1.1.8
Magento 1.2.0
Magento 1.2.0.1
Magento 1.2.0.2
Magento 1.2.0.3
Magento 1.2.1
Magento 1.2.1.1
Magento 1.2.1.2
Magento 1.3.0
Magento 1.3.1
Magento 1.3.1.1
Magento 1.3.2
Magento 1.3.2.1
Magento 1.3.2.2
Magento 1.3.2.3
Magento 1.3.2.4
Magento 1.3.3.0
Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1110] Excel Formula Injection via CSV/XML export

Skrevet den 11. december 2017 af i Magento

We have found an additional attack path not covered by issue APPSEC-978, which was resolved in patch https://magento.com/security/patches/supee-5994 for Magento 1.x.A user could provide input that executes a formula when exported and opened in a spreadsheet such as Microsoft Excel. This formula could modify data, export personal data to another site, or cause remote code execution. The spreadsheet typically displayed a warning message, which the user must dismiss, for the attack to succeed.

Note: The code that protects against this attack modifies the exported file by prepending some fields with a space. As a result, this fix can lead to data inconsistency. (Data inconsistency might occur when fields, such as product name or description, start from =, + or – sign.)

If this fix causes problems with your data processing, you can disable it. Be aware, however, that this protection is enabled by default. Disabling can lead to an increased security risk.

To disable this fix, log in to the Admin Panel, then use the System tab to navigate to the Export CSV fields.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1517] Log in as another customer

Skrevet den 11. december 2017 af i Magento

In certain configurations, it was possible to log in as existing store customer while knowing only his email address, not his/her password.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1337] Magento 2 – Arbitrary PHP code execution using language packs

Skrevet den 11. december 2017 af i Magento

If an attacker could trick a user into installing a malicious language package or had access to an installed language package, he/she could remotely deploy an attack when the language-package code was executed.

Part of patch MAGENTO 2.0.4 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3

[ APPSEC-1746] Remote Code Execution using mail vulnerability

Skrevet den 11. december 2017 af i Magento

Zend Framework 1 vulnerability could be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well.

Note: while the vulnerability is scored as critical, few systems were affected. To be affected by the vulnerability the installation has to:

– use sendmail as the mail transport agent

– have specific, non-default configuration settings at System-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-Path (Set Return-Path option set to Yes)

Part of patch SUPEE-9652

This vulnerability affects the following application versions:

Magento 0.1.0-alpha89
Magento 0.1.0-alpha90
Magento 0.1.0-alpha91
Magento 0.1.0-alpha92
Magento 0.1.0-alpha93
Magento 0.1.0-alpha94
Magento 0.1.0-alpha95
Magento 0.1.0-alpha96
Magento 0.1.0-alpha97
Magento 0.1.0-alpha98
Magento 0.1.0-alpha99
Magento 0.1.0-alpha100
Magento 0.1.0-alpha101
Magento 0.1.0-alpha102
Magento 0.1.0-alpha103
Magento 0.1.0-alpha104
Magento 0.1.0-alpha105
Magento 0.1.0-alpha106
Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.1.0
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3

[APPSEC-926] Customer information leak through recurring profile

Skrevet den 11. december 2017 af i Magento

This issue enabled attacker to obtain address (name, address, phone), previous order (items, amounts) and payment method (payment method, recurrence) information from the recurring payment profiles of other store customers.The attacker just create an account with the store. While viewing own recurring profile, the attacker can request an arbitrary recurring profile using a sequential ID. The information was then returned to the attacker.This attack could be fully automated, and a manual proof of concept exists.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1171] Information Disclosure in RSS feed

Skrevet den 11. december 2017 af i Magento

You can download order comments and other order-related information by providing special parameters to the RSS feed request. This information, depending on contents of the order comments, could disclose private information or be used to access customer account or other customer information.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1247] Block cache exploit

Skrevet den 11. december 2017 af i Magento

With access to any CMS functionality, an attacker with administrator permissions could use blocks to exfiltrate information stored in cache. This sensitive information included store configuration, encryption key, and database connection details. Additionally, it was possible to execute code.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1379] Magento 2 – Reflected cross-site scripting in Authorize.net module

Skrevet den 11. december 2017 af i Magento

Several parameters in the Authorize.net payment module were vulnerable to reflected Cross-Site Scripting (XSS) attacks. Existing protection against such malicious parameters was not enough to stop all types of attacks.

Part of patch MAGENTO 2.0.4 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3

[APPSEC-1634] XSS in data fields

Skrevet den 11. december 2017 af i Magento

Some Admin tables do not filter data, which provides an inadvertent opening for reflected cross-site scripting attacks.

Part of patch SUPEE-9767

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2

[APPSEC-945] Customer address leak through checkout

Skrevet den 11. december 2017 af i Magento

Enables an attacker to obtain address information (name, address, phone) from the address books of other store customers. During the checkout process, the attacker could gain access to an arbitrary address book by entering a sequential ID. No payment information is returned. The only requirement for the attacker is to create an account in store, put any product into the cart, and start the checkout process.This attack can be fully automated, and a functional proof of concept exists.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1212] CSRF Delete Items from Cart

Skrevet den 11. december 2017 af i Magento

Magento did not validate the form key when deleting items from the shopping cart using a GET request. As a result, a user could use phishing emails or other malicious attacks to trick a customer into deleting items from his/her cart.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1282] Filter avoidance

Skrevet den 11. december 2017 af i Magento

Implementing filters for XSS in email templates and other Admin features was not sufficient to stop specially crafted exploit strings.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1389] Magento 2 – Application information disclosure

Skrevet den 11. december 2017 af i Magento

Application error messages no longer include the path to the file where the error occurred. Previously, when an unhandled exception occurred, Magento would display an error message that could disclose sensitive information such as the location of the file that produced the unhandled exception. A malicious user could use this information to launch attacks against the application.

Part of patch MAGENTO 2.0.6 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5

[APPSEC-1565] Customer password hash exposed in admin

Skrevet den 11. december 2017 af i Magento

When editing customer information in admin, customer’s password hash was leaked to the page.

Part of patch MAGENTO 2.0.14 AND 2.1.7 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6

[APPSEC-965] Local file path disclosure using media cache

Skrevet den 11. december 2017 af i Magento

Attacker can use fictitious image URLs to generate exceptions that expose internal server paths, regardless of settings.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1306] Malicious files could be uploaded via backend

Skrevet den 11. december 2017 af i Magento

An administrator could upload a file containing executable code to the server as a logo file if they rename the file to a supported image file format. The issue is not exploitable by itself unless the administrator account that has access to configuration is hacked. However, site audits may flag this issue, and it can cause security audits (such as PCI) to fail.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1247] Magento 2 – Block cache exploit

Skrevet den 11. december 2017 af i Magento

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0

[APPSEC-1408] Magento 2 – Data privacy issues in APIs

Skrevet den 11. december 2017 af i Magento

Anonymous users can no longer retrieve the private data of registered customers. To prevent malicious attacks of this type, the quote_id_mask table of the Quote API no longer includes a cart_id_mask value.

Only a registered customer can assign a guest cart to himself. Previously, an anonymous user could modify the state (that is, set an active quote) of a registered customer.

Part of patch MAGENTO 2.0.6 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5

[APPSEC-1626] RCE in video upload

Skrevet den 11. december 2017 af i Magento

Video upload functionality in the admin panel allowed attacker with admin access to scan internal network for open ports/servers and in some configurations to upload executable PHP files.

Part of patch MAGENTO 2.0.14 AND 2.1.7 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6

[APPSEC-977] Admin path disclosure

Skrevet den 11. december 2017 af i Magento

An attacker can force the Admin Login page to appear by directly calling a module, regardless of the URL. This exposes the Admin URL on the page, and makes it easier to initiate password attacks.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1213] Stored XSS via email address

Skrevet den 11. december 2017 af i Magento

During customer registration on the storefront, a user could provide an email address that contained JavaScript code. Magento did not properly validate this email and executes it in Admin context when viewing the order in the backend. This JavaScript code could steal an administrator session or act on behalf of a store administrator.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1263] Magento 2 – XSS in backend via user name

Skrevet den 11. december 2017 af i Magento

During customer registration on the storefront, a user could provide a user name that contained JavaScript code. Magento did not properly validate this name and executed it in the Admin context when editing the user in the backend. This JavaScript code could potentially steal the administrator session or act on behalf of a store administrator.

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1410] Magento 2 – Reflected cross-site scripting in Authorize.net module

Skrevet den 11. december 2017 af i Magento

Part of patch MAGENTO 2.0.6 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5

[APPSEC-1661] UI controllers did not follow ACL

Skrevet den 11. december 2017 af i Magento

Some UI controllers did not check ACL properly, allowing low level administrators extract data they were not authorized to see.

Part of patch MAGENTO 2.0.14 AND 2.1.7 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6

[APPSEC-978] Spreadsheet formula injection

Skrevet den 11. december 2017 af i Magento

Attacker could provide input that executes a formula when exported and opened in a spreadsheet such as Microsoft Excel. The formula can modify data, export personal data to another site, or cause remote code execution. The spreadsheet usually displays a warning message, which the user must dismiss for the attack to succeed.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1270] Guest order view protection code vulnerable to brute-force attack

Skrevet den 11. december 2017 af i Magento

The guest order view protection code made it possible to access guest order information for some orders. (This is due to how the code is generated and compared with stored values.) While the attack cannot target a specific order or allow a user to view all orders, it could be used to extract order information from store.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1270] Magento 2 – Guest order view protection code vulnerable to brute-force attack

Skrevet den 11. december 2017 af i Magento

The guest order view protection code made it possible to access guest order information for some orders. (This was due to how the code was generated and compared with stored values.) While the attack cannot target a specific order or allow a user to view all orders, it could be used to extract order information from store.

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1420] Magento 2- Unauthenticated remote code execution via API

Skrevet den 11. december 2017 af i Magento

Magento no longer permits an unauthenticated user to remotely execute code on the server through APIs. Previously, an unauthenticated user could remotely execute PHP code on the server using either REST or SOAP APIs. (These APIs were enabled by default in most installations.)

Part of patch MAGENTO 2.0.6 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5

[APPSEC-1699] API tokens were not invalidated after disabling admin user

Skrevet den 11. december 2017 af i Magento

API tokens were not invalidated after disabling the admin user, which could lead to continued attacks or unauthorized actions.

Part of patch MAGENTO 2.0.14 AND 2.1.7 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6

[APPSEC-979] Cross site scripting (XSS) using Magento downloader

Skrevet den 11. december 2017 af i Magento

This issue enabled an attacker to execute JavaScript code within the context of a Magento Connect Manager session. If the administrator clicks a malicious link, the session can be stolen, and malicious extensions installed.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 1.1.5
Magento 1.1.6
Magento 1.1.7
Magento 1.1.8
Magento 1.2.0
Magento 1.2.0.1
Magento 1.2.0.2
Magento 1.2.0.3
Magento 1.2.1
Magento 1.2.1.1
Magento 1.2.1.2
Magento 1.3.0
Magento 1.3.1
Magento 1.3.1.1
Magento 1.3.2
Magento 1.3.2.1
Magento 1.3.2.2
Magento 1.3.2.3
Magento 1.3.2.4
Magento 1.3.3.0
Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1177] Disruption of email delivery

Skrevet den 11. december 2017 af i Magento

An error in the email address associated with a store newsletter could interfere with the sending of newsletter email. This error could constitute a Denial of Service attack. In some cases, including accented characters could generate this error.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1282] Magento 2 – Incorrect filter

Skrevet den 11. december 2017 af i Magento

A user could easily bypass the MaliciousCode filter function when entering HTML code. However, Magento rarely uses this filter, and none of its current usages allow unauthenticated user input.

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta5
Magento 0.42.0-beta6
Magento 0.42.0-beta7
Magento 0.42.0-beta8
Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1422] Magento 2 – Customer account takeover

Skrevet den 11. december 2017 af i Magento

Magento no longer allows authenticated customers to change other customers’ account information using either SOAP or REST calls. Magento now confirms that the ID of the customer whose account is being edited matches the authentication token in use. Previously, a malicious user could hijack a customer account by logging in as an authenticated user, then editing the account of any other user. (The SOAP and REST APIs are enabled by default in most installations.)

Part of patch MAGENTO 2.0.6 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5

[APPSEC-1746] Zend Mail vulnerability – continued

Skrevet den 11. december 2017 af i Magento

The vulnerability was fixed in version 2.0.12/2.1.4 but an use case was discovered that could be used to skip the implemented protection. The issue was not directly exploitable in Magento 2.

Part of patch MAGENTO 2.0.14 AND 2.1.7 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.12
Magento 2.0.13
Magento 2.1.4
Magento 2.1.5

[APPSEC-1019] Autoloaded File Inclusion in Magento SOAP API

Skrevet den 11. december 2017 af i Magento

Incorrect validation of a SOAP API request made it possible to autoload code. The exploit required the attacker to first log in with API credentials. Depending on the PHP version and/or configuration settings, code could then be loaded from a remote location.

Part of patch SUPEE-6482

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0

[APPSEC-1179] CSRF leading to execution of admin actions after login

Skrevet den 11. december 2017 af i Magento

A user could execute a CSRF attack on URLs that result in a server-side action (such as deleting customers) when the administrator was logged out. This action was not executed until the administrator logs in after the attack. The attack relies upon phishing — that is, it required the administrator to click on a malicious link — and required the administrator to log in after the attack.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1294] Magento 2 – SQL Injection via layered navigation

Skrevet den 11. december 2017 af i Magento

You could manipulate query parameters to cause blind SQL injection. Blind SQL injection allowed a user to test names or values of database fields, or to download the values of database fields in small chunks and, as a result, use multiple queries to download (but not modify) important parts of Magento database.

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1480 ] Magento 2 – SQL injection in Zend Framework

Skrevet den 11. december 2017 af i Magento

A bug in Zend Framework value escaping allowed a malicious user to inject SQL through the ordering or grouping parameters. While there are no known frontend entry point vulnerabilities that would allow for a full SQL injection, we’ve found an entry point in the Magento Admin panel, and other entry points most likely exist.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta5
Magento 0.42.0-beta6
Magento 0.42.0-beta7
Magento 0.42.0-beta8
Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1

[APPSEC-1752] Stored XSS in admin panel

Skrevet den 11. december 2017 af i Magento

Customer information entered in admin was not properly escaped. This allowed lower level admins to possibly attack other administrators. To exploit this issue, admin access is required.

Part of patch MAGENTO 2.0.14 AND 2.1.7 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.0.10
Magento 2.0.11
Magento 2.0.12
Magento 2.0.13
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4
Magento 2.1.5
Magento 2.1.6

[APPSEC-1005] Cross-site scripting in cart

Skrevet den 11. december 2017 af i Magento

The redirection link on an empty cart page used non-validated user input, which makes it possible to use URL parameters to inject JavaScript code into the page. Cookies and other information could be sent to the attacker, who was impersonating a customer.

Part of patch SUPEE-6285

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1020] SSRF Vulnerability in WSDL file

Skrevet den 11. december 2017 af i Magento

Incorrect encoding of API password could lead to probing internal network resources or remote file inclusion.

Part of patch SUPEE-6482

This vulnerability affects the following application versions:

Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0

[APPSEC-1058] GIF flooding

Skrevet den 11. december 2017 af i Magento

A malicious user could upload a modified image that could cause a script timeout, resulting in a denial of service attack. (This potential vulnerability affects stores that allow users to upload images as a custom option or through the Admin dashboard)

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1212] Magento 2 – CSRF Delete Items from Cart

Skrevet den 11. december 2017 af i Magento

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1481] Magento 2 – Admin users can create backups regardless of privileges

Skrevet den 11. december 2017 af i Magento

Lack of CSRF protection and privilege check allows any Admin user to create a backup of the system. An Admin user could be tricked into clicking on a phishing form that creates a backup, or an Admin user with lesser privileges can access this functionality. This attack has a low risk because creating a backup in itself does not harm the installation.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.1.0

[APPSEC-1012] Cross-site scripting in orders RSS

Skrevet den 11. december 2017 af i Magento

The vulnerability allowed an attacker to include an unescaped customer name in the New Orders RSS feed. By manipulating the customer name, an attacker could inject incorrect or malicious data into the feed, and expose the store to risk.

Patch is part of SUPEE-6285

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1206] CSRF token not validated on backend login page

Skrevet den 11. december 2017 af i Magento

The lack of form protection on the Admin Login page enabled potential request forgery attacks. These forgery attacks required the administrator to be tricked into clicking on a link by phishing or by link hiding.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1211] XSS in categories management

Skrevet den 11. december 2017 af i Magento

It was possible to create a category that contains malicious JavaScript code in the category name. This code would then be executed in other parts of the Admin panel, such as URL Rewrites. To exploit this issue, a user would need admin access to catalog management.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1240] Magento 2 – Injected code could be stored in database

Skrevet den 11. december 2017 af i Magento

JavaScript code that is passed using the Payflow Pro payment module was not sanitized but was saved to the database. This issue by itself was not a security risk. (This issue is related to APPSEC-1239.)

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1212] Magento 2 – CSRF delete items from mini cart

Skrevet den 11. december 2017 af i Magento

Magento did not validate the form key when deleting items from the mini cart using a GET request. As a result, it was possible to trick a customer into deleting items from his/her cart using phishing emails or other link-hiding/obfuscation techniques.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1
Magento 2.1.2
Magento 2.1.3
Magento 2.1.4

[APPSEC-535] Malicious package can overwrite system files

Skrevet den 11. december 2017 af i Magento

Attacker could publish a malicious extension package. When the package was installed by a customer, it could overwrite files on the server. The attacker must first publish a package, and then enticed a customer to install it. The package might contain a malicious load, as well.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 0.1.0-alpha89
Magento 0.1.0-alpha90
Magento 0.1.0-alpha91
Magento 0.1.0-alpha92
Magento 0.1.0-alpha93
Magento 0.1.0-alpha94
Magento 0.1.0-alpha95
Magento 0.1.0-alpha96
Magento 0.1.0-alpha97
Magento 0.1.0-alpha98
Magento 0.1.0-alpha99
Magento 0.1.0-alpha100
Magento 0.1.0-alpha101
Magento 0.1.0-alpha102
Magento 0.1.0-alpha103
Magento 0.1.0-alpha104
Magento 0.1.0-alpha105
Magento 0.1.0-alpha106
Magento 0.1.0-alpha107
Magento 1.3.1
Magento 1.3.1.1
Magento 1.3.2
Magento 1.3.2.1
Magento 1.3.2.2
Magento 1.3.2.3
Magento 1.3.2.4
Magento 1.3.3.0
Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4
Magento 1.9.3.0
Magento 1.9.3.1
Magento 1.9.3.2
Magento 1.9.3.3
Magento 1.9.3.4
Magento 1.9.3.6
Magento 1.9.3.7
Magento 1.9.3.8
Magento 1.9.3.9
Magento 1.9.3.10
Magento 1.9.4.0
Magento 1.9.4.1
Magento 1.9.4.2
Magento 1.9.4.3
Magento 1.9.4.4
Magento 1.9.4.5

[APPSEC-1208] Admin path disclosure via Authorize.net

Skrevet den 11. december 2017 af i Magento

A user could identify the URL for the Magento Admin Panel by calling Authorize.net payment module URLs. While exposure of the Admin path wasn’t a direct security issue, it makes it easier to carry out other malicious attacks, including password guessing or phishing.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1375] Remote Code Execution in admin

Skrevet den 11. december 2017 af i Magento

The import/export functionality in Magento unserialized data supplied from the Admin dashboard without proper checks. This could lead to possible code execution if a malicious user has Magento Admin access, even if access is limited to the import/export functionality.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1255] Magento 2 – Reflected XSS with cookie header

Skrevet den 11. december 2017 af i Magento

Magento sent an unfiltered form key cookie value to the web server as part of the request, and the cookie value is reflected back as part of the form. Reflected XSS issues could lead to attacks in which a trusted site was used in phishing or spam campaigns (for example, redirecting a user to a phishing site).

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1338] Magento 2 – Full Page Cache poisoning

Skrevet den 11. december 2017 af i Magento

It was possible to manipulate the full page cache to store incorrect pages under regular page URL entries.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.1.0
Magento 2.1.0-rc3
Magento 2.1.1

[APPSEC-802] Permissions on log files too broad

Skrevet den 11. december 2017 af i Magento

Log files were created with permission settings that were too broad, that allowed them to be read or altered by another user on the same server. The risk of an internal information leak was low.

Part of patch SUPEE-6285

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1239] Stored XSS in Order Comments

Skrevet den 11. december 2017 af i Magento

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1436] XSS vulnerability in URL processing

Skrevet den 11. december 2017 af i Magento

Magento function related to URL processing incorrectly used user-supplied data from request headers. This could result in a cross-site scripting issue.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1263] Magento 2 – Server-side cross-site scripting via user name

Skrevet den 11. december 2017 af i Magento

During customer registration on the storefront, a malicious user could provide a user name that contained JavaScript code. Magento did not properly validate this name, and the JavaScript could be executed in Admin context when an administrator added the user in the backend or ran a Reviews report. This code could steal the Administrator session or act on behalf of store administrator. This issue was partially fixed in Magento CE and EE 2.0.1, but additional cases were discovered and fixed.

MAGENTO 2.0.4 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2

[APPSEC-1433] Magento 2 – Unauthorized removal of customer address

Skrevet den 11. december 2017 af i Magento

It was possible to trick a user into deleting his/her store address book entries.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9

[APPSEC-847] Store path disclosure

Skrevet den 11. december 2017 af i Magento

Directly accessing the URL of files that are related to Magento Connect produces an exception that included the server path. The exception was generated regardless of the configuration settings that control the display of exceptions.There was a low risk of attackers gaining a sufficient understanding of the site structure to target an attack.

Part of patch SUPEE-6285

This vulnerability affects the following application versions:

Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1260] Stored XSS in Order

Skrevet den 11. december 2017 af i Magento

In certain configurations, Magento uses the HTTP_X_FORWARDED_FOR header as the customer IP address and displayed it without sanitization in the Admin Panel. An attacker could use this header to inject JavaScript code into Order View forms in Admin Panel. The code was then executed when a user visited an Order View form, allowing the take over of an administrator session or for an unauthorized user to execute actions on behalf of an administrator. Note that we do not recommend using this header configuration setting.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-995] Timing attack on hash checking

Skrevet den 11. december 2017 af i Magento

It was theoretically possible to execute a timing attack on the password checking functionality. This was a low-risk vulnerability due to the effort required to execute this attack successfully.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1267] Magento 2 – XSS in Product Custom Options

Skrevet den 11. december 2017 af i Magento

When using products with custom option for file upload, a user could upload a file with a file name that contained JavaScript code. This code could be executed in the Admin Panel context by editing the quote that contains the product, allowing both for the takeover of an administrator session or for an unauthorized user to execute malicious actions on behalf of an administrator.

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1478] Magento 2 – Session did not expire on logout

Skrevet den 11. december 2017 af i Magento

Sessions did not expire after logout, making it possible to steal session cookies and access the customer’s account. This risk primarily occurs when users share a computer to access the site.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9

[APPSEC-852] Cross-site scripting in admin

Skrevet den 11. december 2017 af i Magento

An attacker could inject JavaScript into the title of a Widget from the Magento Admin. The code could be later executed when another administrator opened the Widget page. The risk required the attacker to have administrator access to the store. However, when executed, the attacker could take over other administrator accounts.

Part of patch SUPEE-6285

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1267] XSS in Product Custom Options

Skrevet den 11. december 2017 af i Magento

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-327] CSRF in several forms

Skrevet den 11. december 2017 af i Magento

Improper form key validation leads to possible CSRF attacks on several forms throughout Magento. As a result, a malicious user could create a phishing form that, when clicked by a user, would execute an action such as update cart or login. Note: This issue affects only older versions of Magento.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1268] Editing or Deleting Reviews without permission

Skrevet den 11. december 2017 af i Magento

Insufficient verification of request parameters allowed any user to delete or edit product reviews. The edited reviews were returned to a pending state. This attack did not depend on setting allowing guest users to post reviews. As a result, a malicious user could access the store for spamming purposes or delete all reviews from store.

Part of patch SUPEE-7405 and MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1539 ] Magento 2 – Cross-Site Scripting in section loading

Skrevet den 11. december 2017 af i Magento

It was possible to inject malicious JavaScript code when loading the content section of a request. Note: There was a low risk of this type of attack as the server should not execute code that contains incompatible content types.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1

[APPSEC-996] Customer information leak via RSS and privilege escalation

Skrevet den 11. december 201720. november 2024 af i Magento

Improper check for authorized URL leads to customer information leak (order information, order IDs, customer name). Leaked information simplifies attack on guest Order Review, which exposes customer email, shipping and billing address. In some areas, the same underlying issue can lead to privilege escalation for Admin accounts.

Part of patch SUPEE-6285

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-907] Cross site scripting using Authorize.Net direct post module

Skrevet den 11. december 2017 af i Magento

Enabled an attacker to execute JavaScript in the context of a customer session. If a customer clicks a malicious link, the attacker can steal cookies and hijack the session, which can expose personal information and compromise checkout.

Part of patch SUPEE-5994

This vulnerability affects the following application versions:

Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1

[APPSEC-1276] XSS via custom options

Skrevet den 11. december 2017 af i Magento

A user could insert XSS JavaScript into a custom option title when creating it on the server side. The code could then be executed on the Magento frontend. Although this vulnerability does not directly enable a malicious attack on a store, such unvalidated input should not be allowed in a Magento installation.

Part of patch SUPEE-7405

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2

[APPSEC-1106] Lack of certificate validation enables MitM attacks

Skrevet den 11. december 2017 af i Magento

Lack of certificate validation on calls to external services enables man-in-the-middle attacks on those calls. This resulted in possible disclosure of customer information. The risk was low due to the effort needed to execute such an attack.

Part of patch SUPEE-8788

This vulnerability affects the following application versions:

Magento 1.4.0.0
Magento 1.4.0.1
Magento 1.4.1.0
Magento 1.4.1.1
Magento 1.4.2.0
Magento 1.5.0.1
Magento 1.5.1.0
Magento 1.6.0.0
Magento 1.6.1.0
Magento 1.6.2.0
Magento 1.7.0.0
Magento 1.7.0.1
Magento 1.7.0.2
Magento 1.8.0.0
Magento 1.8.1.0
Magento 1.9.0.0
Magento 1.9.0.1
Magento 1.9.1.0
Magento 1.9.1.1
Magento 1.9.2.0
Magento 1.9.2.1
Magento 1.9.2.2
Magento 1.9.2.3
Magento 1.9.2.4

[APPSEC-1283] Magento 2 – CAPTCHA Bypass

Skrevet den 11. december 2017 af i Magento

A user could bypass CAPTCHA validation on the Magento frontend, which enabled unrestricted password guessing attempts. Even with CAPTCHA protection enabled, this increased the risk of spam or password guessing attacks on customer accounts.

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta4
Magento 0.42.0-beta5
Magento 0.42.0-beta6
Magento 0.42.0-beta7
Magento 0.42.0-beta8
Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2

[APPSEC-1543] Magento 2 – Removal of currently logged-in administrator

Skrevet den 11. december 2017 af i Magento

It was possible to provide a parameter that resulted in the deletion of the currently logged-in user. If form key functionality was turned off, a malicious user could create a CSRF attack to delete the Admin user.

Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE

This vulnerability affects the following application versions:

Magento 0.42.0-beta4
Magento 0.42.0-beta5
Magento 0.42.0-beta6
Magento 0.42.0-beta7
Magento 0.42.0-beta8
Magento 0.42.0-beta9
Magento 0.42.0-beta10
Magento 0.42.0-beta11
Magento 0.74.0-beta1
Magento 0.74.0-beta2
Magento 0.74.0-beta3
Magento 0.74.0-beta4
Magento 0.74.0-beta5
Magento 0.74.0-beta6
Magento 0.74.0-beta7
Magento 0.74.0-beta8
Magento 0.74.0-beta9
Magento 0.74.0-beta10
Magento 0.74.0-beta11
Magento 0.74.0-beta12
Magento 0.74.0-beta13
Magento 0.74.0-beta14
Magento 0.74.0-beta15
Magento 0.74.0-beta16
Magento 1.0.0-beta
Magento 1.0.0-beta2
Magento 1.0.0-beta3
Magento 1.0.0-beta4
Magento 1.0.0-beta5
Magento 1.0.0-beta6
Magento 2.0.0
Magento 2.0.0-rc
Magento 2.0.0-rc2
Magento 2.0.1
Magento 2.0.2
Magento 2.0.3
Magento 2.0.4
Magento 2.0.5
Magento 2.0.6
Magento 2.0.7
Magento 2.0.8
Magento 2.0.9
Magento 2.1.0
Magento 2.1.0-rc1
Magento 2.1.0-rc2
Magento 2.1.0-rc3
Magento 2.1.1