Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
Date: 2024-05
Affected: composer/magento/community-edition, composer/magento/community-edition
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical

Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.


Mitigations:

Architectural layers (MAESTRO):