← Back

CVE-2022-34253

nvd nist
Published: Aug 16, 2022Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.

Affected (20)

Products: Adobe: Commerce · Magento: Magento
Adobe
1 product
Commerce
Magento
1 product
Magento
Configuration A
20 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Commerce
From 2.3.0 to 2.3.7
Commerce
From 2.4.0 to 2.4.3
Commerce
Version 2.3.7
Commerce
Version 2.3.7 p1
Commerce
Version 2.3.7 p2
Commerce
Version 2.3.7 p3
Commerce
Version 2.4.3
Commerce
Version 2.4.3 p1
Commerce
Version 2.4.3 p2
Commerce
Version 2.4.4
Magento
Magento
From 2.3.0 to 2.3.7
Magento
From 2.4.0 to 2.4.3
Magento
Version 2.3.7
Magento
Version 2.3.7 p1
Magento
Version 2.3.7 p2
Magento
Version 2.3.7 p3
Magento
Version 2.4.3
Magento
Version 2.4.3 p1
Magento
Version 2.4.3 p2
Magento
Version 2.4.4

Related CWEs

CWE-91
XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (2)

Source: psirt@adobe.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.