GCVE - cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*

part: a version: 2.3.7 update: -

Vendor	Magento (`aa019b60-1c50-5218-ad20-1f4a9a786d94`)
Product	Magento (`6f0f93c5-be7a-5b05-986f-1521453ea442`)
Edition	*
Language	*
Software edition	open_source
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/firegento/magento`	purl2cpe	2026-06-01 10:18:21.416403
`pkg:magento/project-community-edition`	purl2cpe	2026-06-01 10:18:21.416405

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-42344`	vulnerable	2026-06-08 05:49:29.815783	[CVE-2021-36032] Magento IDOR Leads to Account Takeover HIGH (8.8) Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation. Published: 2022-10-20T16:28:18.473Z Updated: 2024-09-16T16:28:52.349Z Open on db.gcve.eu Reference links https://helpx.adobe.com/security/products/magento/apsb22-38.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36036`	vulnerable	2026-06-08 05:32:49.636247	Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution HIGH (7.2) Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution. Published: 2023-09-06T13:08:11.318Z Updated: 2025-02-27T21:00:40.727Z Open on db.gcve.eu Reference links https://helpx.adobe.com/security/products/magento/apsb21-64.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36023`	vulnerable	2026-06-08 05:32:49.627000	Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution CRITICAL (9.1) Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Published: 2023-09-06T13:08:08.922Z Updated: 2025-02-27T21:00:46.827Z Open on db.gcve.eu Reference links https://helpx.adobe.com/security/products/magento/apsb21-64.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36021`	vulnerable	2026-06-08 05:32:49.622271	Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution HIGH (7.2) Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system. Published: 2023-09-06T13:08:10.513Z Updated: 2024-09-13T15:48:58.422Z Open on db.gcve.eu Reference links https://helpx.adobe.com/security/products/magento/apsb21-64.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.