Skip to content
OpenAdvisories
High WID-SEC-2024-0384 5 CVEs

Adobe Magento: Mehrere Schwachstellen

Published Feb 13, 2024 · Updated Apr 7, 2024 · Revision 2 · de-DE

Vendor: Adobe Product: Magento Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um Cross-Site-Scripting (XSS)-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Magento ist ein Online-Shop System von Adobe.

Vulnerabilities 5

  • Critical 9.1
    CVE-2024-20719

    [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be execute…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Critical 9.1
    CVE-2024-20720

    Command injection in data collector backup due to insufficient patching of CVE-2023-38208

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitati…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 5.4
    CVE-2024-20717

    Stored admin XSS via PayPal authentication certificate

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript …

    Adobe Adobe Commerce
  • Medium 4.9
    CVE-2024-20716

    Force high-usage of resources by generating unlimited coupons: Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust sy…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 4.3
    CVE-2024-20718

    [Spain] CSRF to delete Requisition Lists at Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Revision history

  1. #2

    Exploit aufgenommen

  2. #1

    Initiale Fassung

References