CVE-2023-29289 – Adobe Commerce XML Injection Security feature bypass
https://notcve.org/view.php?id=CVE-2023-29289
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-35.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVE-2023-29295 – Insecure Direct Object Reference (IDOR) in Create Quote Function
https://notcve.org/view.php?id=CVE-2023-29295
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-35.html • CWE-863: Incorrect Authorization •
CVE-2023-29290 – Adobe Commerce Guest Cart Shipping Address Overwrite IDOR
https://notcve.org/view.php?id=CVE-2023-29290
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-35.html • CWE-353: Missing Support for Integrity Check •
CVE-2023-29292 – Server Side Request Forgery (SSRF) in FedEx carrier integration configuration
https://notcve.org/view.php?id=CVE-2023-29292
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-35.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVE-2023-29297 – Admin-to-admin stored XSS via cache poisoning
https://notcve.org/view.php?id=CVE-2023-29297
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-35.html • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •