Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

Vulnerability

Description CVE-2023-38251 is an Uncontrolled Resource Consumption vulnerability in Adobe Commerce. The flaw affects versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier [1]. Root cause analysis points to improper handling of resource allocation in certain requests, allowing an attacker to consume server resources without proper limits.

Attack

Vector Exploitation does not require user interaction, meaning an attacker can trigger the resource consumption remotely by sending specially crafted requests [1]. The attack complexity is low, and no authentication is needed, making it accessible to unauthenticated attackers over the network.

Impact

Successful exploitation leads to a minor application denial-of-service (DoS) condition [1]. While the impact is considered minor, repeated exploitation could degrade service availability for legitimate users. The vulnerability does not affect data integrity or confidentiality.

Mitigation

Adobe has released security updates in October 2023 to address this issue. Users should upgrade to Adobe Commerce 2.4.7, 2.4.6-p3, 2.4.5-p5, or 2.4.4-p6 or later. No workarounds are documented, and the vendor advises applying the latest patches [1]. For Magento Open Source users, the project repository on GitHub provides source code for self-managed deployments [2].