Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.
Metrics
Affected Vendors & Products
References
History
Tue, 17 Sep 2024 11:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Title | Time-based blind SQL injection via customer segment rule configuration at POST /admin/customersegment/index/save/key/{key}/back/edit product attribute | Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
MITRE
Status: PUBLISHED
Assigner: adobe
Published: 2023-10-13T06:15:06.405Z
Updated: 2024-09-17T11:10:33.271Z
Reserved: 2023-07-13T16:21:52.614Z
Link: CVE-2023-38221
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-10-13T07:15:40.777
Modified: 2024-11-21T08:13:07.010
Link: CVE-2023-38221
Redhat
No data.