Skip to content
Fencer Intel
critical —

GHSA-26hq-7286-mg8f json

Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

published 2y ago modified 2y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well.

Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to:

- use sendmail as the mail transport agent

- have specific, non-default configuration settings as described [here](https://magento.com/security/patches/supee-9652#:~:text=settings%20as%20described-,here,-.).

Patch / fix

  • packagist magento/community-edition 1.14.3.2

Is GHSA-26hq-7286-mg8f in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist magento/community-edition
>=1.9.0.0, <1.14.3.2
1.14.3.2

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.