Patch days / June 2023

Adobe Security Updates — June 2023

Tuesday, 13 June 2023

Vulnerabilities: 18
Critical: 1
High: 3
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 1

Critical 9.1
CVE-2023-29297 Admin-to-admin stored XSS via cache poisoning
EPSS 1.4%

All vulnerabilities 18

Critical1 Show

Critical 9.1
CVE-2023-29297 Admin-to-admin stored XSS via cache poisoning
EPSS 1.4%

High3 Show

Medium13 Show

Medium 6.5
CVE-2023-29289 Adobe Commerce XML Injection Security feature bypass
Medium 5.4
CVE-2023-29302 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Medium 5.4
CVE-2023-29304 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Medium 5.4
CVE-2023-29307 Open Redirect on AEM Target
Medium 5.4
CVE-2023-29322 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Medium 5.3
CVE-2023-29287 Adobe Commerce Information Exposure Security feature bypass
Medium 5.3
CVE-2023-29290 Adobe Commerce Guest Cart Shipping Address Overwrite IDOR
Medium 4.9
CVE-2023-29291 Server Side Request Forgery (SSRF) in USPS carrier integration configuration
EPSS 1.1%
Medium 4.9
CVE-2023-29292 Server Side Request Forgery (SSRF) in FedEx carrier integration configuration
Medium 4.3
CVE-2023-29288 Adobe Commerce | Incorrect Authorization (CWE-863)
Medium 4.3
CVE-2023-29294 Bypass Purchase Order Approval using Company User in Adobe Commerce B2B
Medium 4.3
CVE-2023-29295 Insecure Direct Object Reference (IDOR) in Create Quote Function
Medium 4.3
CVE-2023-29296 [Cloud] Customer suspects IDOR vulnerability

Low1 Show

Low 2.7
CVE-2023-29293 Adobe Commerce | Improper Input Validation (CWE-20)
EPSS 1%