Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
References
| Link | Resource |
|---|---|
| https://helpx.adobe.com/security/products/magento/apsb23-17.html | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Apr 2023, 20:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Adobe
Adobe magento Open Source Adobe commerce |
|
| CPE | cpe:2.3:a:adobe:magento_open_source:2.4.4:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:* cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:* cpe:2.3:a:adobe:magento_open_source:2.4.4:p1:*:*:*:*:*:* cpe:2.3:a:adobe:magento_open_source:2.4.5:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* cpe:2.3:a:adobe:magento_open_source:2.4.4:-:*:*:*:*:*:* cpe:2.3:a:adobe:magento_open_source:2.4.5:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:* |
|
| References | (MISC) https://helpx.adobe.com/security/products/magento/apsb23-17.html - Release Notes, Vendor Advisory |
27 Mar 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-27 21:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-22247
Mitre link : CVE-2023-22247
CVE.ORG link : CVE-2023-22247
JSON object : View
Products Affected
adobe
- magento_open_source
- commerce
CWE
CWE-91
XML Injection (aka Blind XPath Injection)