Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Advisory: Adobe Commerce — helpx.adobe.com/security/products/magento/apsb23-50.html Clear all filters
TI-2023-19663 CVE-2023-38251 · GHSA-7pfc-834q-h497

Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

Priority LOW 31

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor appl…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00758 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-400
TI-2023-19631 CVE-2023-38219 · GHSA-3j7w-jp46-9752

Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

Priority MEDIUM 41

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00754 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-79
TI-2023-19632 CVE-2023-38220 · GHSA-grc6-r6f8-xj7c

Full page cache enumeration via cookie X-Magento-Vary

Priority MEDIUM 40

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature b…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00802 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-285
TI-2023-11516 CVE-2023-26367 · GHSA-9mx6-4gg4-85xj

Error based file extraction via PHP filter chains during product bulk import logic

Priority LOW 24

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file sy…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00801 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-20
TI-2023-11515 CVE-2023-26366 · GHSA-8jxc-5f94-22vh

Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

Priority LOW 32

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00861 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-918
TI-2023-19630 CVE-2023-38218 · GHSA-rpc7-gf58-v3x2

Incorrect Authorization - Customer account takeover

Priority MEDIUM 40

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization .

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00883 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-863
TI-2023-19662 CVE-2023-38250 · GHSA-h3g9-cwr6-hphx

Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Priority LOW 38

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Inj…

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00827 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-89
TI-2023-19661 CVE-2023-38249 · GHSA-rq36-9f5f-2gw7

Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Priority LOW 38

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Inj…

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00827 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-89
TI-2023-19633 CVE-2023-38221 · GHSA-ggr8-3hwx-4f2m

Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Priority LOW 38

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Inj…

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00827 Published 2023-10-13 Fixed in 2.4.7-beta2, 2.4.6-p3 +2 CWE-89