Exposure of Magento

CMS, Ecommerce
435
exposure score
33,253
sites use
3
exploited
34
critical
Vexday analysis

Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.

CVEs

349 results
CVE-2020-24406LOWDocument root path disclosure on Maintenance pageEPSS 2.1%CVE-2020-26252HIGHLayout XML RCE Vulnerability in OpenMageEPSS 2.1%CVE-2019-7861—Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18,EPSS 2.0%CVE-2021-36012MEDIUMMagento Commerce Gift Card Business Logic ErrorEPSS 2.0%CVE-2021-36044HIGHMagento Commerce GraphQL Improper Input Validation Could Lead To Denial Of ServiceEPSS 2.0%CVE-2021-32758HIGHLayout XML Arbitrary Code FixEPSS 2.0%CVE-2012-6091—Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.EPSS 2.0%CVE-2019-7876—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authEPSS 2.0%CVE-2019-7885—Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior toEPSS 2.0%CVE-2019-8116—Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. EPSS 1.9%CVE-2021-36043HIGHMagento Commerce Authenticated Blind SSRF Could Lead To Remote Code ExecutionEPSS 1.9%CVE-2019-7896—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authEPSS 1.9%CVE-2019-7895—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authEPSS 1.9%CVE-2019-7942—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authEPSS 1.9%CVE-2019-8122—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An autEPSS 1.9%CVE-2019-8111—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user cEPSS 1.9%CVE-2019-8110—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user cEPSS 1.9%CVE-2019-8150—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user wEPSS 1.9%CVE-2019-8137—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user wEPSS 1.9%CVE-2021-28583HIGHMagento Commerce insecure storage of sensitive documentationEPSS 1.9%