openmage/magento-lts (Packagist)

medium5.3

GHSA-x8jv-q8j2-487cFix available

Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

Packagist / openmage/magento-lts

06 May

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 20.18.0

Fixed in 20.18.0

91 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2, v19.5.3, v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1, v20.10.0, v20.10.1, v20.10.2, v20.11.0, v20.12.0, v20.12.1, v20.12.2, v20.12.3, v20.13.0, v20.14.0, v20.15.0, v20.16.0, v20.17.0, v20.2.0, v20.3.0, v20.4.0, v20.5.0, v20.6.0, v20.7.0, v20.8.0, v20.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "20.18.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.22",
    "v19.4.23",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9",
    "v19.5.0",
    "v19.5.0-rc1",
    "v19.5.0-rc2",
    "v19.5.0-rc3",
    "v19.5.0-rc4",
    "v19.5.0-rc5",
    "v19.5.1",
    "v19.5.2",
    "v19.5.3",
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.19",
    "v20.0.2",
    "v20.0.20",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8",
    "v20.1.0",
    "v20.1.0-rc1",
    "v20.1.0-rc2",
    "v20.1.0-rc3",
    "v20.1.0-rc4",
    "v20.1.0-rc5",
    "v20.1.0-rc6",
    "v20.1.0-rc7",
    "v20.1.1",
    "v20.10.0",
    "v20.10.1",
    "v20.10.2",
    "v20.11.0",
    "v20.12.0",
    "v20.12.1",
    "v20.12.2",
    "v20.12.3",
    "v20.13.0",
    "v20.14.0",
    "v20.15.0",
    "v20.16.0",
    "v20.17.0",
    "v20.2.0",
    "v20.3.0",
    "v20.4.0",
    "v20.5.0",
    "v20.6.0",
    "v20.7.0",
    "v20.8.0",
    "v20.9.0"
  ]
}

medium6.1

GHSA-qpgq-5g92-j5q8Fix available

Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`

Packagist / openmage/magento-lts

05 May

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 20.18.0

Fixed in 20.18.0

91 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2, v19.5.3, v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1, v20.10.0, v20.10.1, v20.10.2, v20.11.0, v20.12.0, v20.12.1, v20.12.2, v20.12.3, v20.13.0, v20.14.0, v20.15.0, v20.16.0, v20.17.0, v20.2.0, v20.3.0, v20.4.0, v20.5.0, v20.6.0, v20.7.0, v20.8.0, v20.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "20.18.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.22",
    "v19.4.23",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9",
    "v19.5.0",
    "v19.5.0-rc1",
    "v19.5.0-rc2",
    "v19.5.0-rc3",
    "v19.5.0-rc4",
    "v19.5.0-rc5",
    "v19.5.1",
    "v19.5.2",
    "v19.5.3",
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.19",
    "v20.0.2",
    "v20.0.20",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8",
    "v20.1.0",
    "v20.1.0-rc1",
    "v20.1.0-rc2",
    "v20.1.0-rc3",
    "v20.1.0-rc4",
    "v20.1.0-rc5",
    "v20.1.0-rc6",
    "v20.1.0-rc7",
    "v20.1.1",
    "v20.10.0",
    "v20.10.1",
    "v20.10.2",
    "v20.11.0",
    "v20.12.0",
    "v20.12.1",
    "v20.12.2",
    "v20.12.3",
    "v20.13.0",
    "v20.14.0",
    "v20.15.0",
    "v20.16.0",
    "v20.17.0",
    "v20.2.0",
    "v20.3.0",
    "v20.4.0",
    "v20.5.0",
    "v20.6.0",
    "v20.7.0",
    "v20.8.0",
    "v20.9.0"
  ]
}

critical9.3

GHSA-2cwr-gcf9-pvxrFix available

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Packagist / openmage/magento-lts

05 May

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 20.18.0

Fixed in 20.18.0

91 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2, v19.5.3, v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1, v20.10.0, v20.10.1, v20.10.2, v20.11.0, v20.12.0, v20.12.1, v20.12.2, v20.12.3, v20.13.0, v20.14.0, v20.15.0, v20.16.0, v20.17.0, v20.2.0, v20.3.0, v20.4.0, v20.5.0, v20.6.0, v20.7.0, v20.8.0, v20.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "20.18.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.22",
    "v19.4.23",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9",
    "v19.5.0",
    "v19.5.0-rc1",
    "v19.5.0-rc2",
    "v19.5.0-rc3",
    "v19.5.0-rc4",
    "v19.5.0-rc5",
    "v19.5.1",
    "v19.5.2",
    "v19.5.3",
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.19",
    "v20.0.2",
    "v20.0.20",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8",
    "v20.1.0",
    "v20.1.0-rc1",
    "v20.1.0-rc2",
    "v20.1.0-rc3",
    "v20.1.0-rc4",
    "v20.1.0-rc5",
    "v20.1.0-rc6",
    "v20.1.0-rc7",
    "v20.1.1",
    "v20.10.0",
    "v20.10.1",
    "v20.10.2",
    "v20.11.0",
    "v20.12.0",
    "v20.12.1",
    "v20.12.2",
    "v20.12.3",
    "v20.13.0",
    "v20.14.0",
    "v20.15.0",
    "v20.16.0",
    "v20.17.0",
    "v20.2.0",
    "v20.3.0",
    "v20.4.0",
    "v20.5.0",
    "v20.6.0",
    "v20.7.0",
    "v20.8.0",
    "v20.9.0"
  ]
}

high8.8

GHSA-3j5q-7q7h-2hhvFix available

OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

Packagist / openmage/magento-lts

21 Apr

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 20.17.0

Fixed in 20.17.0

90 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2, v19.5.3, v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1, v20.10.0, v20.10.1, v20.10.2, v20.11.0, v20.12.0, v20.12.1, v20.12.2, v20.12.3, v20.13.0, v20.14.0, v20.15.0, v20.16.0, v20.2.0, v20.3.0, v20.4.0, v20.5.0, v20.6.0, v20.7.0, v20.8.0, v20.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "20.17.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.22",
    "v19.4.23",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9",
    "v19.5.0",
    "v19.5.0-rc1",
    "v19.5.0-rc2",
    "v19.5.0-rc3",
    "v19.5.0-rc4",
    "v19.5.0-rc5",
    "v19.5.1",
    "v19.5.2",
    "v19.5.3",
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.19",
    "v20.0.2",
    "v20.0.20",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8",
    "v20.1.0",
    "v20.1.0-rc1",
    "v20.1.0-rc2",
    "v20.1.0-rc3",
    "v20.1.0-rc4",
    "v20.1.0-rc5",
    "v20.1.0-rc6",
    "v20.1.0-rc7",
    "v20.1.1",
    "v20.10.0",
    "v20.10.1",
    "v20.10.2",
    "v20.11.0",
    "v20.12.0",
    "v20.12.1",
    "v20.12.2",
    "v20.12.3",
    "v20.13.0",
    "v20.14.0",
    "v20.15.0",
    "v20.16.0",
    "v20.2.0",
    "v20.3.0",
    "v20.4.0",
    "v20.5.0",
    "v20.6.0",
    "v20.7.0",
    "v20.8.0",
    "v20.9.0"
  ]
}

medium5.3

GHSA-jg68-vhv3-9r8fFix available

Magento's X-Original-Url header can expose admin url

Packagist / openmage/magento-lts

02 Feb

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 20.16.1

Fixed in 20.16.1

90 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2, v19.5.3, v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1, v20.10.0, v20.10.1, v20.10.2, v20.11.0, v20.12.0, v20.12.1, v20.12.2, v20.12.3, v20.13.0, v20.14.0, v20.15.0, v20.16.0, v20.2.0, v20.3.0, v20.4.0, v20.5.0, v20.6.0, v20.7.0, v20.8.0, v20.9.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "20.16.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.22",
    "v19.4.23",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9",
    "v19.5.0",
    "v19.5.0-rc1",
    "v19.5.0-rc2",
    "v19.5.0-rc3",
    "v19.5.0-rc4",
    "v19.5.0-rc5",
    "v19.5.1",
    "v19.5.2",
    "v19.5.3",
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.19",
    "v20.0.2",
    "v20.0.20",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8",
    "v20.1.0",
    "v20.1.0-rc1",
    "v20.1.0-rc2",
    "v20.1.0-rc3",
    "v20.1.0-rc4",
    "v20.1.0-rc5",
    "v20.1.0-rc6",
    "v20.1.0-rc7",
    "v20.1.1",
    "v20.10.0",
    "v20.10.1",
    "v20.10.2",
    "v20.11.0",
    "v20.12.0",
    "v20.12.1",
    "v20.12.2",
    "v20.12.3",
    "v20.13.0",
    "v20.14.0",
    "v20.15.0",
    "v20.16.0",
    "v20.2.0",
    "v20.3.0",
    "v20.4.0",
    "v20.5.0",
    "v20.6.0",
    "v20.7.0",
    "v20.8.0",
    "v20.9.0"
  ]
}

medium5.4

GHSA-gp6m-fq6h-cjcxNo CVE assignedFix available

Magento LTS vulnerable to stored XSS in admin file form

Packagist / openmage/magento-lts

27 Feb

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.5.0

Fixed in 20.5.0

32 explicitly affected versions

v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1, v20.2.0, v20.3.0, v20.4.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.5.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.19",
    "v20.0.2",
    "v20.0.20",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8",
    "v20.1.0",
    "v20.1.0-rc1",
    "v20.1.0-rc2",
    "v20.1.0-rc3",
    "v20.1.0-rc4",
    "v20.1.0-rc5",
    "v20.1.0-rc6",
    "v20.1.0-rc7",
    "v20.1.1",
    "v20.2.0",
    "v20.3.0",
    "v20.4.0"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.5.3

Fixed in 19.5.3

40 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.5.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.22",
    "v19.4.23",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9",
    "v19.5.0",
    "v19.5.0-rc1",
    "v19.5.0-rc2",
    "v19.5.0-rc3",
    "v19.5.0-rc4",
    "v19.5.0-rc5",
    "v19.5.1",
    "v19.5.2"
  ]
}

high7.5

GHSA-9j5w-2cqc-cwj9No CVE assignedFix available

Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

Packagist / openmage/magento-lts

08 Dec

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 20.2.0

Fixed in 20.2.0

70 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.22, v19.4.23, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9, v19.5.0, v19.5.0-rc1, v19.5.0-rc2, v19.5.0-rc3, v19.5.0-rc4, v19.5.0-rc5, v19.5.1, v19.5.2, v19.5.3, v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.19, v20.0.2, v20.0.20, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8, v20.1.0, v20.1.0-rc1, v20.1.0-rc2, v20.1.0-rc3, v20.1.0-rc4, v20.1.0-rc5, v20.1.0-rc6, v20.1.0-rc7, v20.1.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "20.2.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.22",
    "v19.4.23",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9",
    "v19.5.0",
    "v19.5.0-rc1",
    "v19.5.0-rc2",
    "v19.5.0-rc3",
    "v19.5.0-rc4",
    "v19.5.0-rc5",
    "v19.5.1",
    "v19.5.2",
    "v19.5.3",
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.19",
    "v20.0.2",
    "v20.0.20",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8",
    "v20.1.0",
    "v20.1.0-rc1",
    "v20.1.0-rc2",
    "v20.1.0-rc3",
    "v20.1.0-rc4",
    "v20.1.0-rc5",
    "v20.1.0-rc6",
    "v20.1.0-rc7",
    "v20.1.1"
  ]
}

high8.8

GHSA-5j2g-3ph4-rgvmFix available

Fix for authenticated remote code execution through layout update

Packagist / openmage/magento-lts

27 Jan

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.22

Fixed in 19.4.22

30 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.22"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.19

Fixed in 20.0.19

18 explicitly affected versions

v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.2, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.19"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.2",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8"
  ]
}

medium4.9

GHSA-3p73-mm7v-4f6mFix available

DoS vulnerability in MaliciousCode filter

Packagist / openmage/magento-lts

27 Jan

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.22

Fixed in 19.4.22

30 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.22"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.19

Fixed in 20.0.19

18 explicitly affected versions

v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.2, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.19"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.2",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8"
  ]
}

high7.2

GHSA-5vpv-xmcj-9q85Fix available

Fix for arbitrary file deletion in customer media allows for remote code execution

Packagist / openmage/magento-lts

27 Jan

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.22

Fixed in 19.4.22

30 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.22"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.19

Fixed in 20.0.19

18 explicitly affected versions

v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.2, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.19"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.2",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8"
  ]
}

medium4.3

GHSA-r3c9-9j5q-pwv4Fix available

magento-lts Reset Password not protected against well-timed CSRF

Packagist / openmage/magento-lts

26 Jan

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.22

Fixed in 19.4.22

30 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.15, v19.4.16, v19.4.17, v19.4.18, v19.4.19, v19.4.2, v19.4.20, v19.4.21, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.22"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.15",
    "v19.4.16",
    "v19.4.17",
    "v19.4.18",
    "v19.4.19",
    "v19.4.2",
    "v19.4.20",
    "v19.4.21",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.19

Fixed in 20.0.19

18 explicitly affected versions

v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.13, v20.0.14, v20.0.15, v20.0.16, v20.0.17, v20.0.18, v20.0.2, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.19"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.13",
    "v20.0.14",
    "v20.0.15",
    "v20.0.16",
    "v20.0.17",
    "v20.0.18",
    "v20.0.2",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8"
  ]
}

high

GHSA-26rr-v2j2-25fhFix available

Layout XML Arbitrary Code Fix

Packagist / openmage/magento-lts

30 Aug

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.15

Fixed in 19.4.15

23 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.2, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.15"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.2",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.13

Fixed in 20.0.13

12 explicitly affected versions

v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.2, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.13"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.2",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8"
  ]
}

high

GHSA-xm9f-vxmx-4m58Fix available

Data Flow Sanitation Issue Fix

Packagist / openmage/magento-lts

30 Aug

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.15

Fixed in 19.4.15

23 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.13, v19.4.14, v19.4.2, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.15"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.13",
    "v19.4.14",
    "v19.4.2",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.13

Fixed in 20.0.13

12 explicitly affected versions

v20.0.0, v20.0.1, v20.0.10, v20.0.11, v20.0.12, v20.0.2, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.13"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.10",
    "v20.0.11",
    "v20.0.12",
    "v20.0.2",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8"
  ]
}

critical9.1

GHSA-fvrf-9428-527mFix available

Backport for CVE-2021-21024 Blind SQLi from Magento 2

Packagist / openmage/magento-lts

22 Apr

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.13

Fixed in 19.4.13

21 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.10, v19.4.11, v19.4.12, v19.4.2, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7, v19.4.8, v19.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.13"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.10",
    "v19.4.11",
    "v19.4.12",
    "v19.4.2",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7",
    "v19.4.8",
    "v19.4.9"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.9

Fixed in 20.0.9

9 explicitly affected versions

v20.0.0, v20.0.1, v20.0.2, v20.0.3, v20.0.4, v20.0.5, v20.0.6, v20.0.7, v20.0.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.2",
    "v20.0.3",
    "v20.0.4",
    "v20.0.5",
    "v20.0.6",
    "v20.0.7",
    "v20.0.8"
  ]
}

high8.0

GHSA-jrgf-vfw2-hj26Fix available

RCE via PHP Object injection via SOAP Requests

Packagist / openmage/magento-lts

30 Oct

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.8

Fixed in 19.4.8

16 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.2, v19.4.3, v19.4.4, v19.4.5, v19.4.6, v19.4.7

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.8"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.2",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5",
    "v19.4.6",
    "v19.4.7"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.4

Fixed in 20.0.4

4 explicitly affected versions

v20.0.0, v20.0.1, v20.0.2, v20.0.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.4"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1",
    "v20.0.2",
    "v20.0.3"
  ]
}

high8.0

GHSA-crf2-xm6x-46p6Fix available

Observable Timing Discrepancy in OpenMage LTS

Packagist / openmage/magento-lts

19 Aug

openmage/magento-lts Packagist

Ecosystem versions

Earlier releases before 19.4.6

Fixed in 19.4.6

14 explicitly affected versions

1.9.1.1, 1.9.2.0, 1.9.2.1, 1.9.2.2, 1.9.2.3, 1.9.2.4, 1.9.3.0, 1.9.3.1, v19.4.0, v19.4.1, v19.4.2, v19.4.3, v19.4.4, v19.4.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "19.4.6"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.9.1.1",
    "1.9.2.0",
    "1.9.2.1",
    "1.9.2.2",
    "1.9.2.3",
    "1.9.2.4",
    "1.9.3.0",
    "1.9.3.1",
    "v19.4.0",
    "v19.4.1",
    "v19.4.2",
    "v19.4.3",
    "v19.4.4",
    "v19.4.5"
  ]
}

openmage/magento-lts Packagist

Ecosystem versions

From 20.0.0 before 20.0.2

Fixed in 20.0.2

2 explicitly affected versions

v20.0.0, v20.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "20.0.0"
        },
        {
          "fixed": "20.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v20.0.0",
    "v20.0.1"
  ]
}

Set up in your agent.

openmage/magento-lts

Check the version you ship.

Advisories & recorded fixes

Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

Magento's X-Original-Url header can expose admin url

Magento LTS vulnerable to stored XSS in admin file form

Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

Fix for authenticated remote code execution through layout update

DoS vulnerability in MaliciousCode filter

Fix for arbitrary file deletion in customer media allows for remote code execution

magento-lts Reset Password not protected against well-timed CSRF

Layout XML Arbitrary Code Fix

Data Flow Sanitation Issue Fix

Backport for CVE-2021-21024 Blind SQLi from Magento 2

RCE via PHP Object injection via SOAP Requests

Observable Timing Discrepancy in OpenMage LTS