9.1

CVE-2022-34253

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.

Data is provided by the National Vulnerability Database (NVD)
Adobe ≫ Commerce Version >= 2.3.0 < 2.3.7
Adobe ≫ Commerce Version >= 2.4.0 < 2.4.3
Adobe ≫ Commerce Version2.3.7 Update-
Adobe ≫ Commerce Version2.3.7 Updatep1
Adobe ≫ Commerce Version2.3.7 Updatep2
Adobe ≫ Commerce Version2.3.7 Updatep3
Adobe ≫ Commerce Version2.4.3 Update-
Adobe ≫ Commerce Version2.4.3 Updatep1
Adobe ≫ Commerce Version2.4.3 Updatep2
Adobe ≫ Commerce Version2.4.4 Update-
Magento ≫ Magento SwEditioncommerce Version >= 2.3.0 < 2.3.7
Magento ≫ Magento SwEditioncommerce Version >= 2.4.0 < 2.4.3
Magento ≫ Magento Version2.3.7 Update- SwEditioncommerce
Magento ≫ Magento Version2.3.7 Updatep1 SwEditioncommerce
Magento ≫ Magento Version2.3.7 Updatep2 SwEditioncommerce
Magento ≫ Magento Version2.3.7 Updatep3 SwEditioncommerce
Magento ≫ Magento Version2.4.3 Update- SwEditioncommerce
Magento ≫ Magento Version2.4.3 Updatep1 SwEditioncommerce
Magento ≫ Magento Version2.4.3 Updatep2 SwEditioncommerce
Magento ≫ Magento Version2.4.4 Update- SwEditioncommerce
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 37.19% 0.971
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
psirt@adobe.com 9.1 2.3 6
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-91 XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.