Components Vulnerabilities Pricing MCP

Docs

composer

openmage

magento-lts

v19.4.18

magento-lts v19.4.18

openmage

PublishedSep 3, 2022•Policy

compliance

composer Registry

Developer Trust Score

N/A

Recommended Version:x.y.zBest

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

openmage/magento-lts v19.4.18 | Vulnerabil… | Sonatype Guide

composer

openmage

magento-lts

v19.4.18

magento-lts v19.4.18

openmage

PublishedSep 3, 2022•Policy

compliance

composer Registry

Developer Trust Score

N/A

Recommended Version:x.y.zBest

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

Severity

Critical (0)

High (6)

Medium (0)

Low (0)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV Status

Published

7.2CVE-2021-39217

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.

affected

SeverityHigh

PublishedJan 27, 2023

8.8CVE-2021-41144

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

affected

SeverityHigh

PublishedJan 27, 2023

7.5CVE-2023-23617

OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.

affected

SeverityHigh

PublishedJan 27, 2023

7.2CVE-2021-41143

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

affected

SeverityHigh

PublishedJan 27, 2023

7.2CVE-2021-41231

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

affected

SeverityHigh

PublishedJan 27, 2023

7.5sonatype-2016-0133

jquery - Uncontrolled Resource Consumption

affected

SeverityHigh

Published

Mar 28, 2017