PT-2023-5990 · Adobe · Commerce

Published

2023-10-03

·

Updated

2023-10-14

·

CVE-2023-38250

CVSS v3.1

8.0

High

VectorAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-beta1 and earlier Adobe Commerce versions 2.4.6-p2 and earlier Adobe Commerce versions 2.4.5-p4 and earlier Adobe Commerce versions 2.4.4-p5 and earlier
Description The issue is related to the lack of protection against SQL query structure attacks in Adobe Commerce and Magento Open Source. This could allow a remote attacker to execute arbitrary code. The exploitation of this issue does not require user interaction and has high attack complexity, as it requires knowledge of tooling beyond just using the UI. An admin-privilege authenticated attacker could lead to arbitrary code execution.
Recommendations For Adobe Commerce versions 2.4.7-beta1 and earlier, update to a version that includes a fix for this issue. For Adobe Commerce versions 2.4.6-p2 and earlier, update to a version that includes a fix for this issue. For Adobe Commerce versions 2.4.5-p4 and earlier, update to a version that includes a fix for this issue. For Adobe Commerce versions 2.4.4-p5 and earlier, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to SQL commands to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-06691
CVE-2023-38250
GHSA-H3G9-CWR6-HPHX

Affected Products

Commerce