CVE-2023-26366 - Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

Back Back to CVE browser

MEDIUM

Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

Published Oct 13, 2023

5.6

MEDIUM

CVSS 4.0

EPSS 0.73%

Description

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.

Affected products

Vendor Adobe Product Adobe Commerce Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=2.4.7-beta1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Adobe

Adobe Commerce

affected

Version	Status	Constraints
0	affected	<=2.4.7-beta1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://github.com/advisories/GHSA-8jxc-5f94-22vh
Advisory
https://helpx.adobe.com/security/products/magento/apsb23-50.html
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-26366

Link	Providers	Tags
https://github.com/advisories/GHSA-8jxc-5f94-22vh		Advisory
https://helpx.adobe.com/security/products/magento/apsb23-50.html		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-26366