{"id":"GHSA-6wm4-3rjj-c8xx","aliases":[],"title":"Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"SUPEE-10975, Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 contain multiple security enhancements that help close remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.","severity":"critical","score":null,"published":"2024-05-15T22:33:24.000Z","modified":"2024-05-15T22:33:25.000Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"magento/community-edition","sources":[{"name":"OSV · GHSA-6wm4-3rjj-c8xx","url":"https://osv.dev/vulnerability/GHSA-6wm4-3rjj-c8xx"}],"ranges":[{"events":[{"introduced":"1.5.0.0"},{"fixed":"1.9.4.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.9.4.0"]}],"sourceAffected":[],"references":["https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/2018-11-28.yaml","https://github.com/magento/magento2","https://web.archive.org/web/20200929120610/https://magento.com/security/patches/supee-10975"],"sources":[{"name":"OSV","id":"GHSA-6wm4-3rjj-c8xx","modified":"2024-05-15T22:33:25Z","url":"https://osv.dev/vulnerability/GHSA-6wm4-3rjj-c8xx"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T17:10:31.931Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}