Magento Commerce vulnerabilities

9 known vulnerabilities in Magento Commerce from Adobe. 9 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Magento Commerce: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-38208Aug 9, 2023AdobeEPSS 2.47%

  Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code exec

• 7.2 High severity

  Magento Commerce: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2023-29297Jun 15, 2023AdobeEPSS 1.35%

  Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privile

• 7.5 High severity

  Magento Commerce: Incorrect Authorization

  CVE-2023-22248Jun 15, 2023AdobeEPSS 1.02%

  Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak anothe

• 7.5 High severity

  Magento Commerce: XML Injection

  CVE-2023-22247Mar 27, 2023Adobe

  Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injecti

• 9.8 Critical severity

  Magento Commerce: Improper Authorization

  CVE-2022-34256Aug 16, 2022AdobeEPSS 2.21%

  Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user

• 8.8 High severity

  Magento Commerce: Incorrect Authorization

  CVE-2022-34255Aug 16, 2022AdobeEPSS 2.36%

  Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vuln

• 8.8 High severity

  Magento Commerce: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-34254Aug 16, 2022AdobeEPSS 2.33%

  Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could be abused by an attacker to inject malicio

• 7.2 High severity

  Magento Commerce: XML Injection

  CVE-2022-34253Aug 16, 2022AdobeEPSS 5.16%

  Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code

• 10.0 High severity

  Adobe Commerce and Magento Open Source Improper Input Validation Exploited

  CVE-2022-24086Feb 16, 2022AdobeEPSS 99.2%

  Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code ex