Magento Open Source, 1.9.x

Patch Releases

As part of our ongoing commitment to excellence in platform security and performance, we periodically release patches that address specific issues and update the code.

Make sure to stop by our Magento Security Center, and sign up for the Security Alert Registry to receive direct notification from our security team of any emerging issues and solutions.

As patches become available, we also post notification to your Admin Inbox, on the Download page of the Magento site, and through our merchant and partner portals. In addition, registered customers receive notification by email.

We recommend that you install any security-related patch as soon as possible. For step-by-step instructions, see Installing Magento Patches. For a list of all available patches by version, see the Magento Community Edition Patches section of the download page.

Magento Community Edition Patches

2015 Patches

SUPEE-6788 Patch Bundle

Date of Release: 10/27/2015

This patch bundle protects your Magento installation against several potential threats, and includes a new configuration setting that helps manage the backward compatibility of the patch for extensions and customizations. The first patch in the bundle was included in the Magento Community 1.9.2.1 release. However, versions of Magento Community prior to 1.9.2.1 need this critical patch.

Important! This patch breaks backward compatibility, and can impact extensions and customizations.

Admin Routing Compatibility Mode

To help manage the compatibility of extensions and customizations, the following setting has been added to the Admin > Security configuration:

Field	Scope	Description
Admin routing compatibility mode for extensions	Global	Allows you to verify that all extensions and customizations are compatible before the patch is enabled.

We recommend that you install the patch first in the test environment, and try disabling the compatibility mode. If you discover issues, set Admin Routing Compatibility back to “Enabled." If your extensions and customizations work correctly, you can deploy the fully-enabled patch to production. If you discover issues accessing extensions or customizations from the Admin, set Admin Routing Compatibility Mode to “Disabled” before deploying the patch to production. Then, update the impacted customizations and extensions as needed.

We urge you to enable Admin Routing Compatibility Mode as soon as possible to protect your installation from automated attacks. To learn more, see the technical details in the Security Center.

Cross-site Scripting Using Unvalidated Headers

Patch Details
Type:	Cross-site Scripting / Stored Cache Poisoning
CVSSv3 Severity:	9.3 (Critical)
Known Attacks:	None
Description:	Unvalidated host header leaks into response and page. Because the page can be cached, this leak poses a risk for all store customers because any HTML or JavaScript code can be injected. Such an exploit works only with specific server configurations, and allows an attacker to intercept a session or modify a page with fake credit card forms, etc.
Product(s) Affected:	Magento CE prior to 1.9.2.1 Magento EE prior to 1.14.2.1
Fixed In:	CE 1.9.2.2 and EE 1.14.2.1
Reference ID:	APPSEC-1030
Reporter:	Internal (ECG)

Error Reporting in Setup Exposes Configuration

Patch Details
Type:	Information Leakage (Internal)
CVSSv3 Severity:	7.5 (High)
Known Attacks:	None
Description:	Error messages generated during the Magento installation, or during a failed extension installation, can expose the Magento configuration and database access credentials. In most cases, the database server is configured to prevent external connections. In other cases, the information can be exploited, or tied to another attack.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1102
Reporter:	Alberto Assmann

Filter Directives Can Allow Access to Protected Data

Patch Details
Type:	Information Leakage
CVSSv3 Severity:	7.5 (High)
Known Attacks:	None
Description:	Email template filter functionality can be used to call blocks and expose customer information such as last orders, or integration passwords. Although safe when used internally by Magento, it has been reported that this functionality might be used by some external extensions to process blog comments and other user input. Such use of the email template filter functionality can expose protected information on the storefront. To learn more, see the technical details in the Security Center.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1057
Reporter:	Peter O’Callaghan

XXE/XEE Attack on Zend XML Functionality Using Multibyte Payloads

Patch Details
Type:	XXE/XEE (XML Injection)
CVSSv3 Severity:	7.5 (High)
Known Attacks:	None
Description:	Magento can be forced to read XML via API calls that contain ENTITY references to local files, which makes it possible to read password or configuration files. Although Zend Framework filters out ENTITY references, they can be encoded as multibyte characters to avoid detection. To learn more about this Zend Framework issue, see: Zend Changelog 1.12.14.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1045
Reporter:	Dawid Golunski

Potential SQL Injection in Magento Core Model Base Classes

Patch Details
Type:	SQL Injection
CVSSv3 Severity:	7.4 (High)
Known Attacks:	None
Description:	The `addFieldtoFilter` method does not escape the field name. Although core Magento functionality is not affected, this issue might impact third-party extensions, such as those used for layered navigation. Such extensions might be exploited from the storefront to execute any SQL queries. To learn more, see the technical details in the Security Center.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1063
Reporter:	Jim O’Halloran (Aligent)

Potential Remote Code Execution Using Cron

Patch Details
Type:	Remote Code Execution
CVSSv3 Severity:	7.2 (High)
Known Attacks:	None
Description:	The `cron.php` script is available for anyone to call. Because the script can make command line functions calls, it becomes a potential target for the Shellshock vulnerability. (Your server should already be protected against Shellshock.) Additionally, because the command that is passed to shell is not escaped, a directory with the same name as a shell command can be used to execute code. Such an attack requires access to create directories with arbitrary names, such as hosting panel. Although the severity is ranked as high, the attack is not exploitable by itself.
Product(s) Affected:	Magento CE from 1.8.0.0 to 1.9.2.1 Magento EE from 1.13.0.0 to 1.14.2.1
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1037
Reporter:	Dawid Golunski

Remote Code Execution / Information Leak Using File Custom Option

Patch Details
Type:	Remote Code Execution / Information Leakage
CVSSv3 Severity:	6.5 (Medium)
Known Attacks:	None
Description:	Custom option values are not cleared when the custom option type is switched. This makes it possible to inject malicious serialized code into a custom option of the “text” type, and execute it by switching the custom option type to “file.” This remote code execution attack requires the store to use custom options, and have an administration account with access to catalog/products. Additionally, the manipulation of custom options from the storefront makes it possible to read system files. To learn more, see the technical details in the Security Center.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1079
Reporter:	Peter O'Callaghan

Cross-site Scripting with Error Messages

Patch Details
Type:	Cross-site Scripting (CSS) - Reflected
CVSSv3 Severity:	6.1 (Medium)
Known Attacks:	None
Description:	Error messages on storefront pages are not escaped correctly, which makes the site vulnerable to cross-site scripting.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1039
Reporter:	Ultra Security

Potential Remote Code Execution Using Error Reports and Downloadable Products

Patch Details
Type:	Remote Code Execution (RCE)
CVSSv3 Severity:	6.1 (Medium)
Known Attacks:	None
Description:	It is possible to put unvalidated information, including code, into error report files. When combined with Admin access to the catalog, an attacker can create a fake downloadable product that executes PHP code that was previously uploaded to the server. To fully execute the attack, the attacker must have valid credentials for an Admin account that has full permission to access product resources.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1032
Reporter:	Hannes Karlsson

Admin Path Disclosure

Patch Details
Type:	Information Leakage (Internal)
CVSSv3 Severity:	5.3 (Medium)
Known Attacks:	None
Description:	Although this patch is disabled by default, it helps protect against automated attacks. By calling a module directly, an attacker can force the Admin Login page to load in the browser. The Admin URL appears in the address bar, which makes it easier to launch a password attack. To learn more, see the technical details in the Security Center. To help manage the compatibility of extensions and customizations, the Admin Routing Compatibility Mode setting has been added to the Admin > Security configuration. Follow the procedure outlined at the beginning of the release notes to verify that your extensions and customizations work correctly. If issues are discovered, you can install the patch with Admin Routing Compatibility disabled to give you the opportunity to update any impacted extensions or customizations. We urge you to enable Admin Routing Compatibility Mode as soon as possible to protect your installation from automated attacks. To learn more, see the technical details in the Security Center.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1034
Reporter:	Nils Preuss

Insufficient Protection of Password Reset Process

Patch Details
Type:	Account Takeover
CVSSv3 Severity:	3.8 (Low)
Known Attacks:	None
Description:	The token that is used to reset a password is passed with a `GET` request, and is not canceled after use. As a result, the token can be leaked through the referrer field to all external services that are called on the page, such as image servers, analytics, and ads. The token might then be reused to steal the customer’s password.
Product(s) Affected:	Magento CE prior to 1.9.2.2 Magento EE prior to 1.14.2.2
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1027
Reporter:	Vishnu dfx

Dev Folder Not Protected

Patch Details
Type:	Information Leakage (Internal)
CVSSv3 Severity:	0 (None)
Known Attacks:	None
Description:	The Magento dev folder, including functional tests, lacked a proper `.htaccess` file to prevent browser access. As a best practice, all files and directories that are not intended for public view should be protected.
Product(s) Affected:	Magento CE from 1.9.2.0 to 1.9.2.1 Magento EE from 1.14.2.0 to 1.14.2.1
Fixed In:	CE 1.9.2.2 and EE 1.14.2.2
Reference ID:	APPSEC-1124
Reporter:	Internal

SUPEE-6482 Patch Bundle

Date of Release: 08/04/2015

This patch bundle protects your Magento installation against several potential threats. The first two patches apply to both Magento Community and Magento Enterprise installations. The second two patches are for Magento Enterprise installations only. This patch is a proactive, preventative measure, as there are no known attacks at this time.

Autoloaded File Inclusion in Magento SOAP API

Patch Details
Type:	Remote Code Execution (RCE)
CVSS Severity:	6.5 (Medium)
Known Attacks:	None
Description:	Incorrect validation of a SOAP API request makes it possible to autoload code. The exploit requires the attacker to first log in with API credentials. Depending on the PHP version and/or configuration settings, code can then be loaded from a remote location.
Product(s) Affected:	Magento CE prior to 1.9.2.1 Magento EE prior to 1.14.2.1
Fixed In:	CE 1.9.2.1 and EE 1.14.2.1
Reporter:	Egidio Danilo Romano

SSRF Vulnerability in WSDL File

Patch Details
Type:	Remote File Inclusion
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	Incorrect encoding of API password can lead to probing internal network resources or remote file inclusion.
Product(s) Affected:	Magento CE prior to 1.9.2.1 Magento EE prior to 1.14.2.1
Fixed In:	CE 1.9.2.1 and EE 1.14.2.1
Reporter:	Matthew Barry

For Magento Enterprise Edition Only

Cross-site Scripting Using Unvalidated Headers
Patch Details
Type:	Cross-site Scripting/Cache Poisoning
CVSS Severity:	9.3 (Critical)
Known Attacks:	None
Description:	Unvalidated host header leaks into response and page. Because the page can be cached, this leak poses a risk for all store customers because any HTML or JavaScript code can be injected. Such an exploit works only with specific server configurations, and allows an attacker to intercept a session or modify a page with fake credit card forms, etc.
Product(s) Affected:	Magento EE prior to 1.14.2.1
Fixed In:	EE 1.14.2.1
Reporter:	Internal (ECG)

XSS in Gift Registry Search
Patch Details
Type:	Cross-site Scripting (XSS)
CVSS Severity:	6.1 (Medium)
Known Attacks:	None
Description:	Cross-site scripting vulnerability affects registered users. Attack through unescaped search parameter. Risk of cookie theft and impersonating as the user.
Product(s) Affected:	Magento EE prior to 1.14.2.1
Fixed In:	EE 1.14.2.1
Reporter:	Hannes Karlsson/Vaimo

SUPEE-6285 Patch Bundle

Date of Release: 07/07/2015

This bundle includes protection against the following security-related issues:

Customer Information Leak via RSS and Privilege Escalation

Patch Details
Type:	Privilege Escalation / Insufficient Data Protection
CVSS Severity:	7.5 (high)
Known Attacks:	None
Description:	Improper check for authorized URL leads to customer information leak (order information, order IDs, customer name). Leaked information simplifies attack on guest Order Review, which exposes customer email, shipping and billing address. In some areas, the same underlying issue can lead to privilege escalation for Admin accounts.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Erik Wohllebe

Request Forgery in Magento Connect Leads to Code Execution

Patch Details
Type:	Cross-site Request Forgery
CVSS Severity:	9.3 (Critical)
Known Attacks:	None
Description:	Cross-site request forgery in Magento Connect Manager allows an attacker to execute actions such as the installation of a remote module that leads to the execution of remote code. The attack requires a Magento store administrator, while logged in to Magento Connect Manager, to click a link that was prepared by the attacker.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Nicolas Melendez

Cross-site Scripting in Wishlist

Patch Details
Type:	Cross-site Scripting
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	This vulnerability makes it possible to include an unescaped customer name when Wishlist are sent. By manipulating the customer name, an attacker can use the store to send spoofing or phishing emails.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Bastian Ike

Cross-site Scripting in Cart

Patch Details
Type:	Cross-site Scripting (XSS)
CVSS Severity:	6.1 (Medium)
Known Attacks:	None
Description:	The redirection link on an empty cart page uses non-validated user input, which makes it possible to use URL parameters to inject JavaScript code into the page. Cookies and other information can be sent to the attacker, who is impersonating a customer.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Hannes Karlsson

Store Path Disclosure

Patch Details
Type:	Information Leakage (Internal)
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	Directly accessing the URL of files that are related to Magento Connect produces an exception that includes the server path. The exception is generated regardless of the configuration settings that control the display of exceptions.There is a low risk of attackers gaining a sufficient understanding of the site structure to target an attack.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Ryan Satterfield

Permissions on Log Files too Broad

Patch Details
Type:	Information Leakage (Internal)
CVSS Severity:	3.8 (Low)
Known Attacks:	None
Description:	Log files are created with permission settings that are too broad, that allows them to be read or altered by another user on the same server. The risk of an internal information leak is low.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Ryan Satterfield

Cross-site Scripting in Admin

Patch Details
Type:	Cross-site Scripting
CVSS Severity:	6.5 (Medium)
Known Attacks:	None
Description:	An attacker can inject JavaScript into the title of a Widget from the Magento Admin. The code can be later executed when another administrator opens the Widget page. The risk requires the attacker to have administrator access to the store. However, when executed, the attacker can take over other administrator accounts.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0.
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Sasi Levi

Cross-site Scripting in Orders RSS

Patch Details
Type:	Cross-site Scripting
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	The vulnerability allows an attacker to include an unescaped customer name in the New Orders RSS feed. By manipulating the customer name, an attacker can inject incorrect or malicious data into the feed, and expose the store to risk.
Product(s) Affected:	Magento EE prior to 1.14.2.1 Magento CE prior to 1.9.2.0
Fixed In:	EE 1.14.2.1, CE 1.9.2.0
Reporter:	Bastian Ike

SUPEE-5994 Patch Bundle

Date of Release: 05/14/2015

SUPEE-5994 is a bundle of eight patches that resolves the following security-related issues. The patch can be downloaded from the Downloads section of your Magento account.

Admin Path Disclosure

Patch Details
Type:	Information Leakage (Internal)
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	An attacker can force the Admin Login page to appear by directly calling a module, regardless of the URL.This exposes the Admin URL on the page, and makes it easier to initiate password attacks.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	Peter O'Callaghan

Customer Address Leak through Checkout

Patch Details
Type:	Information Disclosure / Leakage (Confidential or Restricted)
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	Enables an attacker to obtain address information (name, address, phone) from the address books of other store customers. During the checkout process, the attacker can gain access to an arbitrary address book by entering a sequential ID. No payment information is returned. The only requirement for the attacker is to create an account in store, put any product into the cart, and start the checkout process. This attack can be fully automated, and a functional proof of concept exists.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	Erik Wohllebe

Customer Information Leak through Recurring Profile

Patch Details
Type:	Information Disclosure / Leakage (Confidential or Restricted)
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	This issue enables attacker to obtain address (name, address, phone), previous order (items, amounts) and payment method (payment method, recurrence) information from the recurring payment profiles of other store customers. The attacker just create an account with the store. While viewing own recurring profile, the attacker can request an arbitrary recurring profile using a sequential ID. The information is then returned to the attacker. This attack can be fully automated, and a manual proof of concept exists.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	Manuel Iglesias

Local File Path Disclosure Using Media Cache

Patch Details
Title:	Local File Path Disclosure Using Media Cache
Type:	Information Leakage (Internal)
CVSS Severity:	5.3 (Medium)
Known Attacks:	None
Description:	Attacker can use fictitious image URLs to generate exceptions that expose internal server paths, regardless of settings.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	Omar M

Cross-site Scripting (XSS) Using Magento Downloader

Patch Details
Type:	Cross-site Scripting (XSS)
CVSS Severity:	8.2 (High)
Known Attacks:	None
Description:	This issue enables an attacker to execute JavaScript code within the context of a Magento Connect Manager session. If the administrator clicks a malicious link, the session can be stolen, and malicious extensions installed.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	Robert Foggia / Trustwave

Spreadsheet Formula Injection

Patch Details
Type:	Formula Injection
CVSS Severity:	6.1 (Medium)
Known Attacks:	None
Description:	Attacker can provide input that executes a formula when exported and opened in a spreadsheet such as Microsoft Excel. The formula can modify data, export personal data to another site, or cause remote code execution. The spreadsheet usually displays a warning message, which the user must dismiss for the attack to succeed.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	iSec Partners (external audit)

Cross-site Scripting Using Authorize.Net Direct Post Module

Patch Details
Type:	Cross-Site Scripting (XSS)
CVSS Severity:	6.1 (Medium)
Known Attacks:	None
Description:	Enables an attacker to execute JavaScript in the context of a customer session. If a customer clicks a malicious link, the attacker can steal cookies and hijack the session, which can expose personal information and compromise checkout.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	Matthew Barry

Malicious Package Can Overwrite System Files

Patch Details
Type:	Abuse of Functionality
CVSS Severity:	3.1 (Low)
Known Attacks:	None
Description:	Attacker can publish a malicious extension package. When the package is installed by a customer, it can overwrite files on the server. The attacker must first publish a package, and then entice a customer to install it. The package might contain a malicious load, as well.
Product(s) Affected:	All current versions of Magento CE Magento EE up to 1.14.2.1
Fixed In:	CE 1.9.2.0, EE 1.14.2.1
Reporter:	iSec Partners (external audit)

SUPEE-5344 Patch

Date of Release: 02/19/2015

This patch addresses a specific remote code execution (RCE) vulnerability known as the “shoplift bug” that allows hackers to obtain Admin access to a store. To determine if your store has been patched, see the Shoplift Bug Test. If your store is not protected, you must immediately download and install the patch from the from the Downloads section of your Magento account.

Patch Details
Type:	Remote Code Execution
CVSS Severity:	9.1 (Critical)
Known Attacks:	Yes
Description:	Authentication bypass uses special parameter that allows the execution of Admin action. The Admin action is vulnerable to SQL injection, which allows code to be inserted into the database and executed. As a result, the store can be fully compromised by creating counterfeit administrator accounts and/or installing malware on the server.
Product(s) Affected:	Magento CE prior to 1.9.1.1 Magento EE prior to 1.14.2.0.
Fixed In:	EE 1.14.2.0, CE 1.9.1.1
Reporter:	Netanel Rubin