VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 27, 2023· Updated Jun 17, 2026

CVE-2023-22247

CVE-2023-22247

Description

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
magento/community-editionPackagist
>= 2.4.5-p1, < 2.4.5-p22.4.5-p2
magento/community-editionPackagist
>= 2.4.4-p1, < 2.4.4-p32.4.4-p3
magento/project-community-editionPackagist
<= 2.0.2—

Affected products

15
  • Adobe Inc./Magento Commercecpe-rescue
    Range: unspecified
  • ghsa-coords2 versions
    pkg:composer/magento/community-editionpkg:composer/magento/project-community-edition
    >= 2.4.5-p1, < 2.4.5-p2+ 1 more
    • (no CPE)range: >= 2.4.5-p1, < 2.4.5-p2
    • (no CPE)range: <= 2.0.2
  • Adobe Inc./Commerce6 versions
    cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*range: <2.4.4
    • cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*
  • Adobe Inc./Magento Open Source6 versions
    cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*range: <2.4.4
    • cpe:2.3:a:adobe:magento_open_source:2.4.4:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_open_source:2.4.4:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_open_source:2.4.4:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_open_source:2.4.5:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:magento_open_source:2.4.5:p1:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.