GHSA-cv25-3pxr-4q7x

Magento Open Source Security Advisory: Patch SUPEE-10975

Critical Packagist

Severity: Critical; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 1.14.4.0; Upgrade magento/community-edition to this version or later

Description

Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated:

PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication
MAG-23: M1 Credit Card Storage Capability
PRODSECBUG-2149: Authenticated RCE using customer import
PRODSECBUG-2159: API Based RCE Vulnerability
PRODSECBUG-2156: RCE Via Unauthorized Upload
PRODSECBUG-2155: Authenticated RCE using dataflow
PRODSECBUG-2053: Prevents XSS in Newsletter Template
PRODSECBUG-2142: XSS in CMS Preview
PRODSECBUG-1860: Admin Account XSS Attack Cessation via Filename
PRODSECBUG-2119: EE Patch to include names in templates
PRODSECBUG-2129: XSS in Google Analytics Vulnerability
PRODSECBUG-2019: Merchant Wishlist Security Strengthening
PRODSECBUG-2104: Send to a Friend Vulnerability
PRODSECBUG-2125: CSRF on deletion of Blocks Vulnerability
PRODSECBUG-2088: CSRF Vulnerability related to Customer Group Deletion
PRODSECBUG-2140: CSRF on deletion of Site Map
PRODSECBUG-2108: Outdated jQuery causing PCI scanning failures
MAG-12, MAG-2: Encryption Keys Stored in Plain Text
PRODSECBUG-2141: Unauthorized Admin Panel Bypass

Patching and Upgrading:

Patches and upgrades are available for the following Magento versions:

Magento Commerce 1.9.0.0-1.14.4.0: Apply SUPEE-10975 or upgrade to Magento Commerce 1.14.4.0. Magento Open Source 1.5.0.0-1.9.4.0: Apply SUPEE-10975 or upgrade to Magento Open Source 1.9.4.0.

Affected versions

Packagist

Package	Vulnerable	Fixed in
magento/community-edition	`>= 1.9.0.0, < 1.14.4.0`	`1.14.4.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

magento/community-edition Packagist → `1.14.4.0`

composer

composer require magento/community-edition:^1.14.4.0

References

Packages

github.com/magento/magento2

Timeline

May 15, 2024 Published

Advisory	Severity	Why it's related
GHSA-wh92-6q6g-px7j Magento Community Edition Improper Input Validation vulnerability	Critical Known exploited	Also affects magento/community-edition
GHSA-m8cj-3v68-3cxj Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability	Critical Known exploited	Also affects magento/community-edition
GHSA-f8fv-f786-9933 Magento improper input validation vulnerability	Critical Known exploited	Also affects magento/community-edition
GHSA-qvwr-p3hj-j6jf Magento vulnerable to privilege escalation due to incorrect authorization	Medium	Also affects magento/community-edition
GHSA-pcrx-r49h-x2w5 Magento vulnerable to stored Cross-Site Scripting (XSS)	Medium	Also affects magento/community-edition
GHSA-r355-75hw-r8jf Magento allows incorrect authorization	Medium	Also affects magento/community-edition
GHSA-2768-5wmv-cfff Magento vulnerable to stored Cross-Site Scripting (XSS)	High	Also affects magento/community-edition
GHSA-69x9-xp2j-w8g8 Magento provides incorrect authorization through a security feature bypass	High	Also affects magento/community-edition

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor