PT-2023-5322 · Adobe · Commerce

Published 2023-08-08 · Updated 2023-09-14 · CVE-2023-38207

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.6-p1 and earlier Adobe Commerce versions 2.4.5-p3 and earlier Adobe Commerce versions 2.4.4-p4 and earlier

Description The issue is related to errors in processing XML requests, which could allow a remote attacker to disclose protected information by transmitting specially crafted XML data. Exploitation of this issue does not require user interaction. It is a XML Injection vulnerability, also known as Blind XPath Injection, that could lead to minor arbitrary file system read.

Recommendations For Adobe Commerce versions 2.4.6-p1 and earlier, update to a version that fixes the XML Injection vulnerability. For Adobe Commerce versions 2.4.5-p3 and earlier, update to a version that fixes the XML Injection vulnerability. For Adobe Commerce versions 2.4.4-p4 and earlier, update to a version that fixes the XML Injection vulnerability. As a temporary workaround, consider restricting the processing of XML requests to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

BDU:2023-05949

CVE-2023-38207

GHSA-RPV2-G4PC-WP72

Affected Products

Commerce

References · 9

• https://osv.dev/vulnerability/CVE-2023-38207 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpv2-g4pc-wp72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38207 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb23-42.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05949 · Security Note
• https://github.com/magento/magento2 · Note
• https://cybersecurity-help.cz/vdb/SB2023080893 · Note
• https://t.me/cvenotify/56061 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1689227843287306241 · Twitter Post