-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from path disclosure during maintenance mode. Magento's maintenance mode implementation uses specific error templates and file handling logic. The 503.phtml template (rendered during maintenance) and maintenance mode file handlers are prime candidates for path leakage, as they might inadvertently expose server paths through debug information or environment variable usage. The medium confidence reflects the lack of direct access to patch details, but aligns with common patterns in PHP application vulnerabilities where error templates or maintenance handlers leak sensitive paths.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | < 2.3.6 | 2.3.6 |
| magento/community-edition | composer | = 2.4.0 | 2.4.1 |
PHPPHPOngoing coverage of React2Shell