Exposição de Magento
CMS, Ecommerce435
score de exposição
33.253
sites usam
3
em exploração
34
críticos
Análise Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2021-28563MEDIUMMagento Commerce improper Authorization via the 'Create Customer' endpointEPSS 1.4%CVE-2020-9665—Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation couEPSS 1.4%CVE-2021-28566LOWMagento Commerce information disclosure during upload action leveraging a specially crafted fileEPSS 1.4%CVE-2019-8231—In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can exeEPSS 1.4%CVE-2019-8230—In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settinEPSS 1.4%CVE-2019-8229—In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes EPSS 1.4%CVE-2021-36027MEDIUMMagento Commerce Stored Cross-site Scripting VulnerabilityEPSS 1.4%CVE-2021-28556MEDIUMMagento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript executionEPSS 1.4%CVE-2023-29297CRITICALAdmin-to-admin stored XSS via cache poisoningEPSS 1.4%CVE-2021-32759HIGHData Flow Sanitation Issue FixEPSS 1.3%CVE-2021-39217HIGHOpenMage LTS arbitrary command execution in custom layout update through blocksEPSS 1.3%CVE-2021-41143HIGHOpenMage LTS arbitrary file deletion in customer media allows for remote code executionEPSS 1.3%CVE-2022-35689MEDIUMAdobe Commerce Improper Access Control Security feature bypassEPSS 1.3%CVE-2019-8093—An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user EPSS 1.3%CVE-2019-8158—An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craftEPSS 1.3%CVE-2020-15244HIGHRCE in MagentoEPSS 1.3%CVE-2019-8127—A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privEPSS 1.3%CVE-2019-7871—A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execEPSS 1.3%CVE-2023-41879HIGHMagento LTS's guest order "protect code" can be brute-forced too easilyEPSS 1.3%CVE-2019-8136—An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraEPSS 1.2%