Magento Commerce

Vendor:

First CVE: Oct 16, 2020 · Active for 5 years

85

Total CVEs

More Total CVEs than 99% of tracked products

21.3

Avg CVEs / Year

Higher CVE frequency than 98% of tracked products

6.4

Avg CVSS

Higher Avg CVSS than 28% of tracked products

1.2%

KEV Rate

Higher KEV Rate than 96% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Magento Commerce over time

Volume of CVEsAvg CVSS Base Score

First CVE

Oct 16, 2020

5 years ago

Most Recent CVE

Aug 9, 2023

1,081 days ago

CVE Severity & Scoring

Magento Commerce85 CVEs

52%

32%

12%

All CVEs352,708 CVEs

45%

40%

11%

LowMediumHighCritical

Attack Vector

Local1 (1.2%)

Network84 (98.8%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low79 (92.9%)

High6 (7.1%)

Unknown0 (0.0%)

User Interaction

None70 (82.4%)

Unknown0 (0.0%)

Required15 (17.6%)

Privileges Required

Low19 (22.4%)

High39 (45.9%)

None27 (31.8%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (85 CVEs).

85 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2022-24086CRITICAL Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of th	Feb 16, 2022	9.8	98	YES	YES
CVE-2021-21029MEDIUM Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful	Feb 11, 2021	4.8	61	NO	NO
CVE-2022-34258MEDIUM Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abuse	Aug 16, 2022	4.8	54	NO	NO
CVE-2023-22249MEDIUM Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privilege	Mar 27, 2023	4.8	46	NO	NO
CVE-2020-24407CRITICAL Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abus	Nov 9, 2020	9.1	31	NO	NO
CVE-2022-34256CRITICAL Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privileg	Aug 16, 2022	9.8	30	NO	NO
CVE-2021-36020CRITICAL Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated	Sep 1, 2021	9.8	30	NO	NO
CVE-2021-21014CRITICAL Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbit	Feb 11, 2021	9.1	29	NO	NO
CVE-2022-34255HIGH Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privile	Aug 16, 2022	8.8	28	NO	NO
CVE-2022-34254HIGH Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path	Aug 16, 2022	8.8	28	NO	NO

View all 85 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (85 CVEs).

CISA KEV

1 CVE

1.2% of CVEs· 96th percentile

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

1 CVE

1.2% of CVEs· 96th percentile

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (85 CVEs).

Media Mentions

Signals from CVEs in this product scope (85 CVEs).

Top CNAs Publishing CVEs For Magento Commerce

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
2.4.4	1	5.3	0.7%
2.4.3	1	5.3	0.7%
2.4.1	1	5.3	4.0%
2.4.0	1	5.3	4.0%
2.3.7	1	5.3	0.7%