Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.
Advisories
Source ID Title
EUVD EUVD EUVD-2023-30186 Magento Open Source allows Server-Side Request Forgery (SSRF)
Github GHSA Github GHSA GHSA-8jxc-5f94-22vh Magento Open Source allows Server-Side Request Forgery (SSRF)
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2025-02-27T20:41:10.099Z

Reserved: 2023-02-22T19:47:52.379Z

Link: CVE-2023-26366

cve-icon Vulnrichment

Updated: 2024-08-02T11:46:24.567Z

cve-icon NVD

Status : Modified

Published: 2023-10-13T07:15:38.933

Modified: 2024-11-21T07:51:12.390

Link: CVE-2023-26366

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.