PT-2023-6093 · Adobe · Commerce
Publicado
2023-10-10
·
Atualizado
2023-10-14
·
CVE-2023-26366
CVSS v3.1
6.8
Média
| Vetor | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Adobe Commerce versions 2.4.7-beta1 and earlier
Adobe Commerce versions 2.4.6-p2 and earlier
Adobe Commerce versions 2.4.5-p4 and earlier
Adobe Commerce versions 2.4.4-p5 and earlier
Description
The issue is related to a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, and the scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary. The vulnerability is associated with insufficient checking of incoming requests.
Recommendations
For Adobe Commerce versions 2.4.7-beta1 and earlier, update to a version that includes the fix for this issue.
For Adobe Commerce versions 2.4.6-p2 and earlier, update to a version that includes the fix for this issue.
For Adobe Commerce versions 2.4.5-p4 and earlier, update to a version that includes the fix for this issue.
For Adobe Commerce versions 2.4.4-p5 and earlier, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the application to minimize the risk of exploitation.
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Commerce