CVE-2023-29297

Deeper analysis

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier are affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability tracked as CWE-1336. This flaw resides in the template engine handling within the Magento-based e-commerce platform and carries a CVSS 3.1 score of 9.1 reflecting network-accessible attack vector, low complexity, high privileges required, and changed scope with high impact on confidentiality, integrity, and availability.

An authenticated attacker possessing administrative privileges can exploit the issue remotely without any user interaction to inject and execute arbitrary code on the affected server, potentially leading to full system compromise.

The official Adobe advisory at https://helpx.adobe.com/security/products/magento/apsb23-35.html details the available patches and mitigation steps for the listed versions. The associated EPSS score has remained flat at a peak of 0.0875 with no material increase observed after disclosure.