CVE-2023-38249 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

🗓️ 13 Oct 2023 06:15:07Reported by adobeType

Adobe Commerce 2.4.7-beta1 and earlier versions are vulnerable to time-based blind SQL injection in the customer segment rule configuration, allowing admin-privilege authenticated attackers to execute arbitrary code

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.	14 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-38249	13 Oct 202312:28	–	circl
CNNVD	Adobe Commerce SQL Injection Vulnerability	13 Oct 202300:00	–	cnnvd
CVE	CVE-2023-38249	13 Oct 202306:15	–	cve
EUVD	EUVD-2023-42069	3 Oct 202520:07	–	euvd
Github Security Blog	Magento Open Source allows SQL Injection	13 Oct 202309:30	–	github
NVD	CVE-2023-38249	13 Oct 202307:15	–	nvd
OSV	GHSA-RQ36-9F5F-2GW7 Magento Open Source allows SQL Injection	13 Oct 202309:30	–	osv
Prion	Sql injection	13 Oct 202307:15	–	prion
Positive Technologies	PT-2023-5991 · Adobe · Commerce	3 Oct 202300:00	–	ptsecurity

[
  {
    "defaultStatus": "affected",
    "product": "Adobe Commerce",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2.4.7-beta1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
helpx	www.helpx.adobe.com/security/products/magento/apsb23-50.html

17 Sep 2024 11:10Current

8.3High risk

Vulners AI Score8.3

CVSS 3.18

EPSS0.00829

CWE-89