~ / search / GHSA-cj7w-pm77-hvg6

GHSA-cj7w-pm77-hvg6

Magento XML Injection vulnerability in the Widgets Module

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-34253

Packages

EcosystemPackageAffectedFixed in
Packagist magento/community-edition < 2.3.7-p4 2.3.7-p4
Packagist magento/community-edition >= 2.4.4, < 2.4.5 2.4.5
Packagist magento/community-edition >= 2.4.0, < 2.4.3-p3 2.4.3-p3

Details

As written in the advisory (Markdown source, shown as plain text).

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.

References

External links from the advisory. They lead to third-party sites.