Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
References
Link | Resource |
---|---|
https://helpx.adobe.com/security/products/magento/apsb23-35.html | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: adobe
Published: 2023-06-15T00:00:00
Updated: 2023-06-15T00:00:00
Reserved: 2023-04-04T00:00:00
Link: CVE-2023-29291
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-06-15T19:15:10.887
Modified: 2023-06-22T15:41:05.567
Link: CVE-2023-29291
JSON object: View
Redhat Information
No data.
CWE