Adobe Commerce XML Injection Security feature bypass

Analysis

An XML Injection vulnerability exists in Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier. The flaw arises from improper handling of XML input, allowing an attacker to inject malicious XML content that triggers a bypass of security features [1].

An attacker with low privileges, such as an authenticated user with basic access, can exploit this vulnerability by crafting a specially crafted script that performs XML injection. The attack does not require any user interaction, increasing its exploitability [1].

Successful exploitation allows the attacker to bypass certain security features, potentially leading to privilege escalation, unauthorized access to sensitive data, or further compromise of the Adobe Commerce instance. The exact impact can vary depending on the configuration and environment [1].

Adobe has released security updates to address this vulnerability. Users are advised to upgrade to the latest versions of Adobe Commerce and Magento Open Source to mitigate the risk. The official NVD entry provides further details and CVSS metrics [1].