Description
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.
No analysis available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2023-30186 | Magento Open Source allows Server-Side Request Forgery (SSRF) |
Github GHSA |
GHSA-8jxc-5f94-22vh | Magento Open Source allows Server-Side Request Forgery (SSRF) |
References
History
Tue, 04 Mar 2025 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Status: PUBLISHED
Assigner: adobe
Published:
Updated: 2025-02-27T20:41:10.099Z
Reserved: 2023-02-22T19:47:52.379Z
Link: CVE-2023-26366
Updated: 2024-08-02T11:46:24.567Z
Status : Modified
Published: 2023-10-13T07:15:38.933
Modified: 2024-11-21T07:51:12.390
Link: CVE-2023-26366
No data.
OpenCVE Enrichment
No data.
Weaknesses
EUVD
Github GHSA