CVE-2023-38249

Summary

CVE-2023-38249 is a newly disclosed SQL Injection vulnerability affecting various versions of Adobe Commerce, including 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier. This issue enables an admin-privileged attacker to execute arbitrary code without user interaction, making it a significant security concern. The vulnerability arises from improper neutralization of special elements used in SQL commands, potentially allowing attackers to manipulate database queries and gain unauthorized access. The exploitation of this vulnerability requires advanced tooling, increasing the attack complexity.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.