Medium GHSA-mcfc-67vm-j568

Magento Cross-Site Scripting (XSS) vulnerability

Published May 15, 2024 · Updated Nov 29, 2024 · Assigned by GHSA

Package: magento/community-edition Ecosystem: Packagist

Description

Magento Commerce and Open Source 2.2.6 and 2.1.15 contain multiple security enhancements that help close Cross-Site Scripting (XSS) and other vulnerabilities.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	magento/community-edition	>= 2.1, < 2.1.15	2.1.15	GHSA-mcfc-67vm-j568
Packagist	magento/community-edition	>= 2.2, < 2.2.6	2.2.6	GHSA-mcfc-67vm-j568

References

https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/2018-09-10.yaml web
https://github.com/magento/magento2 package
https://web.archive.org/web/20210802082439/https://magento.com/security/patches/magento-2.2.6-and-2.1.15-security-update web