CVE-2023-26366

Опубликовано: 13 окт. 2023

Источник: nvd

CVSS3: 6.8

EPSS Низкий

Описание

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.

Ссылки

https://helpx.adobe.com/security/products/magento/apsb23-50.html
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb23-50.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.7:b1:*:*:*:*:*:*

cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*

cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*

EPSS

Процентиль: 55%

0.00324

Низкий

6.8 Medium

CVSS3

Дефекты

CWE-918

Связанные уязвимости

GHSA-8jxc-5f94-22vh

CVSS3: 6.8

github

больше 2 лет назад

Magento Open Source allows Server-Side Request Forgery (SSRF)

BDU:2023-06796

CVSS3: 6.8

fstec

больше 2 лет назад

Уязвимость программных платформ для разработки и управления онлайн магазинами Magento Open Source и Adobe Commerce, связанная с недостаточной проверкой поступающих запросов, позволяющая нарушителю осуществить SSRF-атаку

EPSS

Процентиль: 55%

0.00324

Низкий

6.8 Medium

CVSS3

Дефекты

CWE-918