CVE-2023-29289

Summary

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interaction.

Affected Software

VendorProductVersion RangeStatus
AdobeMagento Commerceunspecified <= 2.4.6affected
AdobeMagento Commerceunspecified <= 2.4.5-p2affected
AdobeMagento Commerceunspecified <= 2.4.4-p3affected
AdobeMagento Commerceunspecified <= Noneaffected

Weaknesses

  • CWE-91: XML Injection (aka Blind XPath Injection) (CWE-91)

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References