deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.4-p1, < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-mmp7-8cg4-9wrg
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Stored Cross-Site Scripting (XSS) vulnerability 

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 2.4.4-p1, < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-q628-54wg-4r5q
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento does not properly restrict excessive authentication attempts

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.4.4-p1, < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-2ff6-837j-hg5x
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
GitHub Security Advisory: GHSA-8frp-pxq2-3gpq
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento OS Command ('OS Command Injection') vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.