GHSA-prpf-cj87-hwvr
Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
No scoreFix available
Magento Commerce 1.14.3.9 and Open Source 1.9.3.9 bring essential security enhancements with Patch SUPEE-10752. These updates address various vulnerabilities, including authenticated Admin user remote code execution (RCE), cross-site request forgery (CSRF), and more.
Key Security Improvements:
- APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML
- APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only)
- APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module)
- APPSEC-2029: PHP Object Injection and Remote Code Execution (RCE) in the Admin panel (Commerce)
- APPSEC-2007: Authenticated SQL Injection when saving a category
- APPSEC-2027: CSRF is possible against Web sites, Stores, and Store Views
- APPSEC-1882: The cron.php file can leak database credentials
- APPSEC-2006: Stored cross-site scripting (XSS) through the Enterprise Logging extension
- APPSEC-2005: Persistent Cross-Site Scripting (XSS) injection in Configuration table
- APPSEC-1880: Cross-Site Scripting (XSS) through the Admin Username in the CMS Revision Editor (Commerce only)
- APPSEC-2004: Cross-Site Scripting (XSS) through Remote File Inclusion
- APPSEC-1988: Path traversal vulnerability in templates
- APPSEC-1987: Reflective cross-site scripting (XSS) through filter manipulation
- APPSEC-2034: XSS in Admin Create Order Configure Product Via Compatible File Extensions
- APPSEC-1876: Cross-site scripting (XSS) in Admin Bundle Product Bundle Items Tab through Product SKU
- APPSEC-1874: Cross-Site Scripting (XSS) in the Admin Gift Registry Type Edit via Attribute Group
- APPSEC-1872: Cross-Site Scripting (XSS) in the Admin Manage Catalog Events list through category name
- APPSEC-1928: Stored XSS in Downloadable Product Links title - frontend
- APPSEC-1871: Cross-Site Scripting (XSS) in the Admin Manage Customer Rewards points history using the Reason field
- APPSEC-1870: Cross-Site Scripting (XSS) in Admin Manage Invitations list through Invitee email address
- APPSEC-1972/APPSEC-2103: Admin password change does not force the logout of the Admin user
- APPSEC-1934: Systemic Cross-Site Request Forgery (CSRF) on the Checkout page
- APPSEC-1917: Password theft though uploaded video and Auth Prompt password theft vulnerability
- APPSEC-1993: IP spoofing
Patches and upgrades are available for the following Magento versions:
- Magento Commerce 1.9.0.0-1.14.3.9: SUPEE-10752 or upgrade to Magento Commerce 1.14.3.9.
- Magento Open Source 1.5.0.0-1.9.3.9: SUPEE-10752 or upgrade to Magento Open Source 1.9.3.9.
What each source reports
GitHub Advisories No score
Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
Magento Commerce 1.14.3.9 and Open Source 1.9.3.9 bring essential security enhancements with Patch SUPEE-10752. These updates address various vulnerabilities, including authenticated Admin user remote code execution (RCE), cross-site request forgery (CSRF), and more.
Key Security Improvements:
- APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML
- APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only)
- APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module)
- APPSEC-2029: PHP Object Injection and Remote Code Execution (RCE) in the Admin panel (Commerce)
- APPSEC-2007: Authenticated SQL Injection when saving a category
- APPSEC-2027: CSRF is possible against Web sites, Stores, and Store Views
- APPSEC-1882: The cron.php file can leak database credentials
- APPSEC-2006: Stored cross-site scripting (XSS) through the Enterprise Logging extension
- APPSEC-2005: Persistent Cross-Site Scripting (XSS) injection in Configuration table
- APPSEC-1880: Cross-Site Scripting (XSS) through the Admin Username in the CMS Revision Editor (Commerce only)
- APPSEC-2004: Cross-Site Scripting (XSS) through Remote File Inclusion
- APPSEC-1988: Path traversal vulnerability in templates
- APPSEC-1987: Reflective cross-site scripting (XSS) through filter manipulation
- APPSEC-2034: XSS in Admin Create Order Configure Product Via Compatible File Extensions
- APPSEC-1876: Cross-site scripting (XSS) in Admin Bundle Product Bundle Items Tab through Product SKU
- APPSEC-1874: Cross-Site Scripting (XSS) in the Admin Gift Registry Type Edit via Attribute Group
- APPSEC-1872: Cross-Site Scripting (XSS) in the Admin Manage Catalog Events list through category name
- APPSEC-1928: Stored XSS in Downloadable Product Links title - frontend
- APPSEC-1871: Cross-Site Scripting (XSS) in the Admin Manage Customer Rewards points history using the Reason field
- APPSEC-1870: Cross-Site Scripting (XSS) in Admin Manage Invitations list through Invitee email address
- APPSEC-1972/APPSEC-2103: Admin password change does not force the logout of the Admin user
- APPSEC-1934: Systemic Cross-Site Request Forgery (CSRF) on the Checkout page
- APPSEC-1917: Password theft though uploaded video and Auth Prompt password theft vulnerability
- APPSEC-1993: IP spoofing
Patches and upgrades are available for the following Magento versions:
- Magento Commerce 1.9.0.0-1.14.3.9: SUPEE-10752 or upgrade to Magento Commerce 1.14.3.9.
- Magento Open Source 1.5.0.0-1.9.3.9: SUPEE-10752 or upgrade to Magento Open Source 1.9.3.9.
- Record
GHSA-prpf-cj87-hwvr- Updated
- 2026-11-02
OSV No score
Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
Magento Commerce 1.14.3.9 and Open Source 1.9.3.9 bring essential security enhancements with Patch SUPEE-10752. These updates address various vulnerabilities, including authenticated Admin user remote code execution (RCE), cross-site request forgery (CSRF), and more.
Key Security Improvements:
- APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML
- APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only)
- APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module)
- APPSEC-2029: PHP Object Injection and Remote Code Execution (RCE) in the Admin panel (Commerce)
- APPSEC-2007: Authenticated SQL Injection when saving a category
- APPSEC-2027: CSRF is possible against Web sites, Stores, and Store Views
- APPSEC-1882: The cron.php file can leak database credentials
- APPSEC-2006: Stored cross-site scripting (XSS) through the Enterprise Logging extension
- APPSEC-2005: Persistent Cross-Site Scripting (XSS) injection in Configuration table
- APPSEC-1880: Cross-Site Scripting (XSS) through the Admin Username in the CMS Revision Editor (Commerce only)
- APPSEC-2004: Cross-Site Scripting (XSS) through Remote File Inclusion
- APPSEC-1988: Path traversal vulnerability in templates
- APPSEC-1987: Reflective cross-site scripting (XSS) through filter manipulation
- APPSEC-2034: XSS in Admin Create Order Configure Product Via Compatible File Extensions
- APPSEC-1876: Cross-site scripting (XSS) in Admin Bundle Product Bundle Items Tab through Product SKU
- APPSEC-1874: Cross-Site Scripting (XSS) in the Admin Gift Registry Type Edit via Attribute Group
- APPSEC-1872: Cross-Site Scripting (XSS) in the Admin Manage Catalog Events list through category name
- APPSEC-1928: Stored XSS in Downloadable Product Links title - frontend
- APPSEC-1871: Cross-Site Scripting (XSS) in the Admin Manage Customer Rewards points history using the Reason field
- APPSEC-1870: Cross-Site Scripting (XSS) in Admin Manage Invitations list through Invitee email address
- APPSEC-1972/APPSEC-2103: Admin password change does not force the logout of the Admin user
- APPSEC-1934: Systemic Cross-Site Request Forgery (CSRF) on the Checkout page
- APPSEC-1917: Password theft though uploaded video and Auth Prompt password theft vulnerability
- APPSEC-1993: IP spoofing
Patches and upgrades are available for the following Magento versions:
- Magento Commerce 1.9.0.0-1.14.3.9: SUPEE-10752 or upgrade to Magento Commerce 1.14.3.9.
- Magento Open Source 1.5.0.0-1.9.3.9: SUPEE-10752 or upgrade to Magento Open Source 1.9.3.9.
- Record
GHSA-prpf-cj87-hwvr- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist |
before 1.9.3.9 | 1.9.3.9 |
magento/community-editionPackagist |
before 1.9.3.9, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3 |
1.9.3.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-prpf-cj87-hwvr is a vulnerability with no CVSS score yet in magento/community-edition, published May 15, 2024. No source lists public exploit code. Fixed in magento/community-edition 1.9.3.9.
References
This page doesn't list everything
Left out here: 3 versions. The JSON record has them.