magento/product-community-edition (Packagist)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 2.3.2-p2 or later clears every advisory below that has a fix.

Upgrade commands

composer

composer require magento/product-community-edition:^2.3.2-p2

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-mgfr-44wv-hqv6 Magento 2 Community Edition XSS Vulnerability	Medium EPSS 0.56%	`>= 2.2, < 2.2.9`	`2.2.9`
GHSA-mgfr-44wv-hqv6 Magento 2 Community Edition XSS Vulnerability	Medium EPSS 0.56%	`>= 2.3, < 2.3.2`	`2.3.2`
GHSA-mgfr-44wv-hqv6 Magento 2 Community Edition XSS Vulnerability	Medium EPSS 0.56%	`>= 2.1, < 2.1.18`	`2.1.18`
GHSA-6qh6-v99h-vh4c Magento 2 Community Edition RCE Vulnerability	High EPSS 1.95%	`>= 2.1, < 2.1.18`	`2.1.18`
GHSA-6qh6-v99h-vh4c Magento 2 Community Edition RCE Vulnerability	High EPSS 1.95%	`>= 2.2, < 2.2.9`	`2.2.9`
GHSA-6qh6-v99h-vh4c Magento 2 Community Edition RCE Vulnerability	High EPSS 1.95%	`>= 2.3, < 2.3.2`	`2.3.2`
GHSA-wmrg-w9vg-7jqx Magento 2 Community Edition CSRF Vulnerability	High EPSS 0.50%	`>= 2.3, < 2.3.2`	`2.3.2`
GHSA-wmrg-w9vg-7jqx Magento 2 Community Edition CSRF Vulnerability	High EPSS 0.50%	`>= 2.1, < 2.1.18`	`2.1.18`
GHSA-wmrg-w9vg-7jqx Magento 2 Community Edition CSRF Vulnerability	High EPSS 0.50%	`>= 2.2, < 2.2.9`	`2.2.9`
GHSA-89ch-hqf9-rgp3 Using JS libraries with known security vulnerabilities	High EPSS 1.24%	`>= 2.2, < 2.2.10`	`2.2.10`
GHSA-89ch-hqf9-rgp3 Using JS libraries with known security vulnerabilities	High EPSS 1.24%	`>= 2.3, < 2.3.2-p2`	`2.3.2-p2`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor