GitHub Advisoryadvisory · Packagist

GHSA-2444-8gj8-6fmx Magento Open Source allows XML Injection

HIGH Published 2023-03-27 Modified 2025-03-04 Official page ↗
Aliases
CVE-2023-22247
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-91
Reviewed
2025-03-04

Affected packages

• Packagist magento/community-edition: >= 2.4.5-p1, < 2.4.5-p2 → fixed in 2.4.5-p2 • Packagist magento/community-edition: 2.4.5 (no fix yet) • Packagist magento/community-edition: >= 2.4.4-p1, < 2.4.4-p3 → fixed in 2.4.4-p3 • Packagist magento/community-edition: 2.4.4 (no fix yet) • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

Related

Alias · CVE (1)

  • CVE-2023-22247 Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to… vulnerability

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References