XML injection in Magento Open Source and Adobe Commerce (formerly Magento Commerce) - CVE-2023-29289
Published: June 16, 2023
Vulnerability identifier: #VU77461
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-29289
CWE-ID: CWE-91
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper input validation when processing XML data. A remote user can pass specially crafted XML data to the application and gain access to sensitive information.
Affected software
Magento Open Source
Adobe Commerce (formerly Magento Commerce)
Adobe Commerce (formerly Magento Commerce)
How to mitigate CVE-2023-29289
Install updates from vendor's website.
Magento Open Source - addressed in versions 2.4.4-p4, 2.4.5-p3, 2.4.6-p1
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.3.7-p4-ext-3, 2.4.0-ext-3, 2.4.1-ext-3, 2.4.2-ext-3, 2.4.3-ext-3, 2.4.4-p4, 2.4.5-p3, 2.4.6-p1
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.3.7-p4-ext-3, 2.4.0-ext-3, 2.4.1-ext-3, 2.4.2-ext-3, 2.4.3-ext-3, 2.4.4-p4, 2.4.5-p3, 2.4.6-p1