Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-6wm4-3rjj-c8xx
GHSA-6wm4-3rjj-c8xx:
PHP vulnerability analysis and mitigation
Overview
SUPEE-10975 is a critical security patch for Magento Commerce and Open Source versions that addresses multiple security vulnerabilities. The patch affects versions >= 1.5.0.0 and < 1.9.4.0 of Magento Community Edition, with the release date of November 28, 2018. This security update contains multiple enhancements to address remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and other vulnerabilities (Magento Advisory, GitHub Advisory).
Technical details
The patch addresses multiple critical vulnerabilities with varying CVSS scores up to 9.0. Key vulnerabilities include brute force prevention in RSS authentication (CVSS 9.0), multiple Remote Code Execution (RCE) vulnerabilities through customer import, API exploitation, and unauthorized file uploads (CVSS 8.5), and several Cross-Site Scripting (XSS) vulnerabilities in various components including Newsletter Template, CMS Preview, and Google Analytics (CVSS 6.5). The patch also removes functionality enabling M1 customers to store credit card data in the database for compliance purposes (Magento Advisory).
Impact
The vulnerabilities could allow attackers to execute remote code, perform brute force attacks, conduct cross-site scripting attacks, and potentially gain unauthorized access to admin accounts. The most severe impacts include possible remote code execution through multiple vectors, unauthorized file uploads, and potential exposure of sensitive data. Additionally, the vulnerabilities could enable attackers to perform privileged actions and chain together multiple attacks for escalated access (Magento Advisory).
Mitigation and workarounds
The recommended mitigation is to upgrade to Magento Open Source 1.9.4.0 or Magento Commerce 1.14.4.0, or apply the SUPEE-10975 patch. The patch is available for Magento Open Source versions 1.5.0.0-1.9.4.0 and Magento Commerce versions 1.9.0.0-1.14.4.0. Users are advised to test the patch in a development environment before deploying to production (Magento Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management