CVE-2023-29297

Summary

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

Affected Software

VendorProductVersion RangeStatus
AdobeMagento Commerceunspecified <= 2.4.6affected
AdobeMagento Commerceunspecified <= 2.4.5-p2affected
AdobeMagento Commerceunspecified <= 2.4.4-p3affected
AdobeMagento Commerceunspecified <= Noneaffected

Weaknesses

  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine(CWE-1336)

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References