High WID-SEC-2023-2009 3 CVEs

Adobe Magento: Mehrere Schwachstellen

Published Aug 8, 2023 · Updated Aug 8, 2023 · de-DE

Vendor: Adobe Product: Magento Product: Magento < 2.4.4-p5 Product: Magento < 2.4.5-p4 Product: Magento < 2.4.6-p2 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um Informationen offenzulegen, Code auszuführen oder seine Rechte zu erweitern.

Product

Magento ist ein Online-Shop System von Adobe.

Vulnerabilities 3

Critical 9.1

CVE-2023-38208

Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code exe…

Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist

Aug 9, 2023
High 7.5

CVE-2023-38207

Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does no…

Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Aug 9, 2023
Medium 6.5

CVE-2023-38209

Adobe Commerce Incorrect Authorization Security feature bypass

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerabilit…

Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist

Aug 9, 2023

Revision history

2023-08-08 #1
Initiale Fassung

References

Adobe Security Bulletin vom 2023-08-08
https://helpx.adobe.com/security/products/magento/apsb23-42.html