Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2023-30186 | Magento Open Source allows Server-Side Request Forgery (SSRF) |
Github GHSA |
GHSA-8jxc-5f94-22vh | Magento Open Source allows Server-Side Request Forgery (SSRF) |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 04 Mar 2025 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Status: PUBLISHED
Assigner: adobe
Published:
Updated: 2025-02-27T20:41:10.099Z
Reserved: 2023-02-22T19:47:52.379Z
Link: CVE-2023-26366
Updated: 2024-08-02T11:46:24.567Z
Status : Modified
Published: 2023-10-13T07:15:38.933
Modified: 2024-11-21T07:51:12.390
Link: CVE-2023-26366
No data.
OpenCVE Enrichment
No data.
EUVD
Github GHSA