Adobe Commerce | Improper Input Validation (CWE-20)

CVE-2023-29293 is an improper input validation vulnerability in Adobe Commerce (and Magento Open Source) that leads to a security feature bypass [1]. The flaw occurs when the software fails to properly validate input in certain administrative functions, enabling an authenticated admin to bypass intended restrictions.

Exploitation requires admin privileges but no user interaction, so an attacker who already has elevated access can trigger the vulnerability without any victim involvement [1]. The attack surface is limited to admin-level functions, meaning the attacker must first obtain high privileges.

The impact is limited to affecting the availability of a "user's minor feature," per the advisory [1]. This suggests the bypass can disrupt a non-critical feature for users but does not compromise sensitive data or lead to full system compromise.

As of the publication date, Adobe has not released additional technical details beyond the initial advisory, and affected versions include 2.4.6, 2.4.5-p2, and 2.4.4-p3 and earlier [1]. Users are advised to follow Adobe's security advisories for updates.