GHSA-5gmh-85x8-5cx7
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
GHSA-5gmh-85x8-5cx7 is a vulnerability with no CVSS score yet in magento/community-edition, published May 15, 2024. No source lists public exploit code. Fixed in magento/community-edition 2.1.14.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.1.14magento/community-edition +3 more
Description
Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist | 2.1 up to 2.1.14 | 2.1.14 |
magento/community-editionPackagist | 2.2 up to 2.2.5 | 2.2.5 |
magento/community-editionPackagist | 2.1 up to 2.1.14, plus listed versions 2.1.02.1.0-rc12.1.0-rc22.1.0-rc32.1.1 Show 12 moreShow less2.1.102.1.112.1.122.1.132.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.9 | 2.1.14 |
magento/community-editionPackagist | 2.2 up to 2.2.5, plus listed versions 2.2.02.2.12.2.22.2.32.2.4 | 2.2.5 |
What each source reports
GitHub AdvisoriesNo score
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.
- Record
GHSA-5gmh-85x8-5cx7- Updated
- 2026-11-02
OSVNo score
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.
- Record
GHSA-5gmh-85x8-5cx7- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.