DependencyTrack / DependencyTrack/dependency-track
Vulnerabilities and versions for Magento 2 and Typo 3
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Currently, I can't see any info about Magento 2 and Typo 3 vulnerabilities and versions
For example: 2.4.7-p7
`pkg:composer/magento/product-community-edition@2.4.5-p7`
There is a [new security patch](https://experienceleague.adobe.com/en/docs/commerce-operations/release/notes/security-patches/2-4-5-patches), and there are some vulnerabilities, for example [CVE-2024-34102](https://nvd.nist.gov/vuln/detail/cve-2024-34102). But I don't see them.
[NVD Vulnerability Search](https://nvd.nist.gov/vuln/search#/nvd/home?cpeFilterMode=cpe&cpeName=cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*&resultType=records)
The Magento repository `https://repo.magento.com/` is configured
### Steps to Reproduce
1. Configure Magento repository: `https://repo.magento.com/`
2. Import SBOM containing `magento/product-community-edition` (composer dependency)
3. Navigate to component: `pkg:composer/magento/product-community-edition@2.4.5-p7`
4. Check vulnerability analysis results
### Expected Behavior
- Vulnerabilities from NVD should be displayed for Magento 2 versions
- Security patches (e.g., 2.4.7-p7) should trigger vulnerability alerts
- TYPO3 vulnerabilities should also be visible
### Dependency-Track Version
4.13.5
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
16.4
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.