DemoBook a demo

Vulnerability advisory

CVE-2023-29287

Adobe Commerce Information Exposure Security feature bypass

Published Updated OSV record ↗

Also known as GHSA-85m4-g9vq-xpxj

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/magento/magento2 ↗
44a7b6079bcac5ba92040b16f4f74024b4f34d09 through d846142a3ab8b49597dfb8bd7508d875efdab19aNo fix listed
Also listed as affected (23)
  • 2.3.7-NA
  • 2.3.7-p1
  • 2.3.7-p2
  • 2.3.7-p3
  • 2.3.7-p4
  • 2.4.0-NA
  • 2.4.0-ext\-1
  • 2.4.1-NA
  • 2.4.1-ext\-1
  • 2.4.2-NA
  • 2.4.2-ext\-1
  • 2.4.2-ext\-2
  • 2.4.3-NA
  • 2.4.3-ext\-1
  • 2.4.3-ext\-2
  • 2.4.4-NA
  • 2.4.4-p1
  • 2.4.4-p2
  • 2.4.4-p3
  • 2.4.5-NA
  • 2.4.5-p1
  • 2.4.5-p2
  • 2.4.6-NA

Description

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. An attacker could leverage this vulnerability to leak minor user data. Exploitation of this issue does not require user interaction..

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.