What is CVE-2023-22247?

CVE-2023-22247 is a high-severity vulnerability in Adobe Commerce, classified under XML Injection (Blind XPath Injection). CVSS score: 7.5/10. Published 2023-03-27.

How severe is CVE-2023-22247?

High severity. CVSS v3 base score is 7.5 out of 10.

XPath Injection in Adobe Commerce

CVE-2023-22247

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

EPSS: 0.009 (58.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Adobe Commerce — versions 2.4.4, 2.4.5
Adobe Magento Commerce — versions unspecified
Adobe Magento_open_source — versions 2.4.4, 2.4.5

Weakness classification (CWE)

CWE-91 — XML Injection (Blind XPath Injection)

References

psirt@adobe.com (Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2023-22247?: CVE-2023-22247 is a high-severity vulnerability in Adobe Commerce, classified under XML Injection (Blind XPath Injection). CVSS score: 7.5/10. Published 2023-03-27.
How severe is CVE-2023-22247?: High severity. CVSS v3 base score is 7.5 out of 10.