Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.
History

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published: 2023-10-13T06:15:11.323Z

Updated: 2025-02-27T20:41:10.099Z

Reserved: 2023-02-22T19:47:52.379Z

Link: CVE-2023-26366

cve-icon Vulnrichment

Updated: 2024-08-02T11:46:24.567Z

cve-icon NVD

Status : Modified

Published: 2023-10-13T07:15:38.933

Modified: 2024-11-21T07:51:12.390

Link: CVE-2023-26366

cve-icon Redhat

No data.