Adobe has released a security update for Adobe Commerce and Magento Open Source, addressing critical and significant vulnerabilities. The update addresses potential exploits that, if successfully manipulated, could lead to arbitrary code execution, privilege escalation, arbitrary file system read, security feature bypass, and application denial-of-service.
The affected versions encompass various release lines of Adobe Commerce and Magento Open Source:
Adobe Commerce: Versions ranging from 2.3.7-p4-ext-4 and earlier to 2.4.7-beta1 and earlier.
Magento Open Source: Versions ranging from 2.4.4-p5 and earlier to 2.4.7-beta1 and earlier.
Note: Some versions are exclusively applicable to customers in the Extended Support Program.
Adobe recommends immediate updates to the following versions for respective platforms:
Adobe Commerce: Versions 2.4.7-beta2, 2.4.6-p3, 2.4.5-p5, 2.4.4-p6, and more.
Magento Open Source: Versions 2.4.7-beta2, 2.4.6-p3, 2.4.5-p5, 2.4.4-p6, and earlier.
Note: Version specifics are available in the release notes for 2.4.x.
The security update addresses critical vulnerabilities categorized by vulnerability impact and severity, including:
Improper Input Validation (CWE-20): Leading to privilege escalation (CVE-2023-38218).
Cross-site Scripting (Stored XSS) (CWE-79): Allowing privilege escalation (CVE-2023-38219).
Improper Authorization (CWE-285): Resulting in security feature bypass (CVE-2023-38220).
SQL Injection (CWE-89): Enabling arbitrary code execution (multiple CVEs: 2023-38221, 2023-38249, 2023-38250).
Information Exposure (CWE-200): Facilitating arbitrary code execution (CVE-2023-26367).
Uncontrolled Resource Consumption (CWE-400): Leading to application denial-of-service (CVE-2023-38251).
Server-Side Request Forgery (SSRF) (CWE-918): Allowing arbitrary file system read (CVE-2023-26366).
Additionally, the update addresses dependency vulnerabilities, notably CVE-2021-41182 in jQuery affecting specific versions of Adobe Commerce.
Given the critical nature of these vulnerabilities, users are strongly urged to update their installations promptly. Failure to do so could leave systems exposed to potential exploitation.
More info can be found at the Abode Security Bulletin.
