Magento Magento 2.4.3 Patch 1 Commerce Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*
part: a version: 2.4.3 update: p1
| Vendor | Magento (aa019b60-1c50-5218-ad20-1f4a9a786d94) |
|---|---|
| Product | Magento (6f0f93c5-be7a-5b05-986f-1521453ea442) |
| Edition | * |
| Language | * |
| Software edition | commerce |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/firegento/magento |
purl2cpe | 2026-06-01 10:18:21.522886 |
pkg:magento/project-community-edition |
purl2cpe | 2026-06-01 10:18:21.522888 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-34259 |
vulnerable | 2026-06-08 05:44:52.498234 |
Adobe Commerce Improper Access Control Security feature bypass
MEDIUM (5.3)
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.
Published: 2022-08-16T19:46:34.063Z
Updated: 2025-04-23T17:49:23.730Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34258 |
vulnerable | 2026-06-08 05:44:52.497383 |
Adobe Commerce Stored XSS Arbitrary code execution
MEDIUM (4.8)
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published: 2022-08-16T19:43:31.144Z
Updated: 2025-04-23T17:50:10.353Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34257 |
vulnerable | 2026-06-08 05:44:52.496644 |
Adobe Commerce Stored XSS Arbitrary code execution
MEDIUM (6.1)
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published: 2022-08-16T19:46:13.161Z
Updated: 2025-04-23T17:49:31.832Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34256 |
vulnerable | 2026-06-08 05:44:52.495857 |
Adobe Commerce Improper Authorization Privilege escalation
HIGH (7.5)
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
Published: 2022-08-16T19:43:53.683Z
Updated: 2025-04-23T17:50:02.705Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34255 |
vulnerable | 2026-06-08 05:44:52.494674 |
Adobe Commerce Improper Access Control Privilege escalation
HIGH (8.8)
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover for a victim. Exploitation of this issue does not require user interaction.
Published: 2022-08-16T19:45:04.523Z
Updated: 2025-04-23T17:49:46.981Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34254 |
vulnerable | 2026-06-08 05:44:52.493781 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34253 |
vulnerable | 2026-06-08 05:44:52.491466 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24086 |
vulnerable | 2026-06-08 05:40:59.588543 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.