Adobe Commerce XML Injection Arbitrary file system read (Adobe Magento Commerce)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.93 % · percentile 60 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
Weaknesses (CWE)
- CWE-91 — XML Injection
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | adobe |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-2444-8gj8-6fmx — Magento Open Source allows XML Injection
European references
- ENISA EUVD · EUVD-2023-26411
- GCVE · GCVE-0-2023-22247
CERT-FR advisories
- CERTFR-2023-AVI-0227 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*< 2.4.4cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*< 2.4.4cpe:2.3:a:adobe:magento_open_source:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:2.4.4:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:2.4.4:p2:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:2.4.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:2.4.5:p1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.5-p1 ; affected unspecified ≤ 2.4.4-p2 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |