Vulnerability advisory
CVE-2022-34254
Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution
Also known as BIT-magento-2022-34254GHSA-fx9g-g9q6-x3jx
Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/devdocs ↗ | |
| 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 through 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 | No fix listed |
Also listed as affected (3)
| |
| GIT github.com/magento/magento2 ↗ | |
| f4c1d7526f05bdfb1327b0701cc345f94aadcaed to before 44a7b6079bcac5ba92040b16f4f74024b4f34d09 | 44a7b6079bcac5ba92040b16f4f74024b4f34d09 |
| 6729b6e01368248abc33300208eb292c95050203 to before 4c36116dcf878e127059d9be9566a119783583f2 | 4c36116dcf878e127059d9be9566a119783583f2 |
| 44a7b6079bcac5ba92040b16f4f74024b4f34d09 through 0f9a056c8d83c4f319626b3e56ec52a533999f25 | No fix listed |
Also listed as affected (8)
| |
Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A low privileged attacker could leverage this vulnerability to read local files and to perform Stored XSS. Exploitation of this issue does not require user interaction.