GHSA-prpf-cj87-hwvr

Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities

Critical Packagist

Severity: Critical; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 1.9.3.9; Upgrade magento/community-edition to this version or later

Description

Magento Commerce 1.14.3.9 and Open Source 1.9.3.9 bring essential security enhancements with Patch SUPEE-10752. These updates address various vulnerabilities, including authenticated Admin user remote code execution (RCE), cross-site request forgery (CSRF), and more.

Key Security Improvements:

APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML
APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only)
APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module)
APPSEC-2029: PHP Object Injection and Remote Code Execution (RCE) in the Admin panel (Commerce)
APPSEC-2007: Authenticated SQL Injection when saving a category
APPSEC-2027: CSRF is possible against Web sites, Stores, and Store Views
APPSEC-1882: The cron.php file can leak database credentials
APPSEC-2006: Stored cross-site scripting (XSS) through the Enterprise Logging extension
APPSEC-2005: Persistent Cross-Site Scripting (XSS) injection in Configuration table
APPSEC-1880: Cross-Site Scripting (XSS) through the Admin Username in the CMS Revision Editor (Commerce only)
APPSEC-2004: Cross-Site Scripting (XSS) through Remote File Inclusion
APPSEC-1988: Path traversal vulnerability in templates
APPSEC-1987: Reflective cross-site scripting (XSS) through filter manipulation
APPSEC-2034: XSS in Admin Create Order Configure Product Via Compatible File Extensions
APPSEC-1876: Cross-site scripting (XSS) in Admin Bundle Product Bundle Items Tab through Product SKU
APPSEC-1874: Cross-Site Scripting (XSS) in the Admin Gift Registry Type Edit via Attribute Group
APPSEC-1872: Cross-Site Scripting (XSS) in the Admin Manage Catalog Events list through category name
APPSEC-1928: Stored XSS in Downloadable Product Links title - frontend
APPSEC-1871: Cross-Site Scripting (XSS) in the Admin Manage Customer Rewards points history using the Reason field
APPSEC-1870: Cross-Site Scripting (XSS) in Admin Manage Invitations list through Invitee email address
APPSEC-1972/APPSEC-2103: Admin password change does not force the logout of the Admin user
APPSEC-1934: Systemic Cross-Site Request Forgery (CSRF) on the Checkout page
APPSEC-1917: Password theft though uploaded video and Auth Prompt password theft vulnerability
APPSEC-1993: IP spoofing

Patches and upgrades are available for the following Magento versions:

Magento Commerce 1.9.0.0-1.14.3.9: SUPEE-10752 or upgrade to Magento Commerce 1.14.3.9.
Magento Open Source 1.5.0.0-1.9.3.9: SUPEE-10752 or upgrade to Magento Open Source 1.9.3.9.

Affected versions

Packagist

Package	Vulnerable	Fixed in
magento/community-edition	`< 1.9.3.9`	`1.9.3.9`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

magento/community-edition Packagist → `1.9.3.9`

composer

composer require magento/community-edition:^1.9.3.9

References

Packages

github.com/magento/magento2

Timeline

May 15, 2024 Published
Nov 29, 2024 Last updated by the source

Advisory	Severity	Why it's related
GHSA-wh92-6q6g-px7j Magento Community Edition Improper Input Validation vulnerability	Critical Known exploited	Also affects magento/community-edition
GHSA-m8cj-3v68-3cxj Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability	Critical Known exploited	Also affects magento/community-edition
GHSA-f8fv-f786-9933 Magento improper input validation vulnerability	Critical Known exploited	Also affects magento/community-edition
GHSA-qvwr-p3hj-j6jf Magento vulnerable to privilege escalation due to incorrect authorization	Medium	Also affects magento/community-edition
GHSA-pcrx-r49h-x2w5 Magento vulnerable to stored Cross-Site Scripting (XSS)	Medium	Also affects magento/community-edition
GHSA-r355-75hw-r8jf Magento allows incorrect authorization	Medium	Also affects magento/community-edition
GHSA-2768-5wmv-cfff Magento vulnerable to stored Cross-Site Scripting (XSS)	High	Also affects magento/community-edition
GHSA-69x9-xp2j-w8g8 Magento provides incorrect authorization through a security feature bypass	High	Also affects magento/community-edition

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor