Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.
History

Tue, 17 Sep 2024 11:15:00 +0000

Type Values Removed Values Added
Title Time-based blind SQL injection via customer segment rule configuration at POST /admin/customersegment/index/save/key/{key}/back/edit default address Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published: 2023-10-13T06:15:07.891Z

Updated: 2024-09-17T11:10:10.183Z

Reserved: 2023-07-13T16:21:52.617Z

Link: CVE-2023-38249

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-10-13T07:15:41.037

Modified: 2024-11-21T08:13:10.773

Link: CVE-2023-38249

cve-icon Redhat

No data.