Skip to content
OpenAdvisories
High WID-SEC-2023-2619 10 CVEs

Adobe Magento: Mehrere Schwachstellen

Published Oct 10, 2023 · Updated Oct 10, 2023 · de-DE

Vendor: Adobe Product: Magento Product: Magento < 2.4.4-p6 Product: Magento < 2.4.5-p5 Product: Magento < 2.4.6-p3 Product: Magento < 2.4.7-beta2

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Magento ist ein Online-Shop System von Adobe.

Vulnerabilities 10

  • High 8.8
    CVE-2023-38218

    Incorrect Authorization - Customer account takeover

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.7
    CVE-2023-38219

    Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject maliciou…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.0
    CVE-2023-38221

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.0
    CVE-2023-38249

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.0
    CVE-2023-38250

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 7.8
    CVE-2023-26368

    Adobe InCopy Out-of-Bounds Read Vulnerability v1.0

    Adobe InCopy versions 18.5 (and earlier) and 17.4.2 (and earlier) are affected by are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could le…

    Adobe InCopy
  • High 7.5
    CVE-2023-38220

    Full page cache enumeration via cookie X-Magento-Vary

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could a…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 6.8
    CVE-2023-26366

    Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged au…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 5.3
    CVE-2023-38251

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 4.9
    CVE-2023-26367

    Error based file extraction via PHP filter chains during product bulk import logic

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authent…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Revision history

  1. #1

    Initiale Fassung

References