Cyber Resilience

CVE-2023-22247

High

Published: 27 March 2023

Published
27 March 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0477 89.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-22247 is a high-severity aka Blind XPath Injection (CWE-91) vulnerability in Adobe Commerce. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 10.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary…

more

URLs. Exploitation of this issue does not require user interaction.

CWE(s)
CWE-91

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

adobe
commerce
2.4.4, 2.4.5 · ≤ 2.4.4
adobe
magento open source
2.4.4, 2.4.5 · ≤ 2.4.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References