CVE-2023-38221 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

🗓️ 13 Oct 2023 06:15:06Reported by adobeType

CVE-2023-38221 Time-based blind SQL injection via customer segment rule configuration at POST /admin/customersegment/index/save/key/{key}/back/edit product attribute Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.	14 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-38221	13 Oct 202312:28	–	circl
CNNVD	Adobe Commerce SQL Injection Vulnerability	13 Oct 202300:00	–	cnnvd
CVE	CVE-2023-38221	13 Oct 202306:15	–	cve
EUVD	EUVD-2023-42041	3 Oct 202520:07	–	euvd
Github Security Blog	Magento Open Source allows SQL Injection	13 Oct 202309:30	–	github
NVD	CVE-2023-38221	13 Oct 202307:15	–	nvd
OSV	GHSA-GGR8-3HWX-4F2M Magento Open Source allows SQL Injection	13 Oct 202309:30	–	osv
Prion	Sql injection	13 Oct 202307:15	–	prion
Positive Technologies	PT-2023-5989 · Adobe · Commerce	3 Oct 202300:00	–	ptsecurity

[
  {
    "defaultStatus": "affected",
    "product": "Adobe Commerce",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2.4.7-beta1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
helpx	www.helpx.adobe.com/security/products/magento/apsb23-50.html

17 Sep 2024 11:10Current

8.3High risk

Vulners AI Score8.3

CVSS 3.18

EPSS0.00829

CWE-89