Adobe Systems Incorporated Magento 1 & 2 vulnerabilities

3 vulnerabilities

Known vulnerabilities in Adobe Systems Incorporated Magento 1 & 2, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.6CVE-2019-8232adobe systems incorporatedmagento 1 & 2+1
EPSS score
0.85%
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.7.2CVE-2019-8114adobe systems incorporatedmagento 1 & 2+1
EPSS score
1.85%
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload.5.4CVE-2019-8152adobe systems incorporatedmagento 1 & 2+1
EPSS score
0.59%
A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.