Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Commerce | Adobe | 2.3.7 (including) | 2.3.7 (including) |
| Commerce | Adobe | 2.3.7-p1 (including) | 2.3.7-p1 (including) |
| Commerce | Adobe | 2.3.7-p2 (including) | 2.3.7-p2 (including) |
| Commerce | Adobe | 2.3.7-p3 (including) | 2.3.7-p3 (including) |
| Commerce | Adobe | 2.3.7-p4 (including) | 2.3.7-p4 (including) |
| Commerce | Adobe | 2.3.7-p4-ext1 (including) | 2.3.7-p4-ext1 (including) |
| Commerce | Adobe | 2.3.7-p4-ext2 (including) | 2.3.7-p4-ext2 (including) |
| Commerce | Adobe | 2.3.7-p4-ext3 (including) | 2.3.7-p4-ext3 (including) |
| Commerce | Adobe | 2.3.7-p4-ext4 (including) | 2.3.7-p4-ext4 (including) |
| Commerce | Adobe | 2.4.0 (including) | 2.4.0 (including) |
| Commerce | Adobe | 2.4.0-ext-1 (including) | 2.4.0-ext-1 (including) |
| Commerce | Adobe | 2.4.0-ext-2 (including) | 2.4.0-ext-2 (including) |
| Commerce | Adobe | 2.4.0-ext-3 (including) | 2.4.0-ext-3 (including) |
| Commerce | Adobe | 2.4.0-ext-4 (including) | 2.4.0-ext-4 (including) |
| Commerce | Adobe | 2.4.1 (including) | 2.4.1 (including) |
| Commerce | Adobe | 2.4.1-ext-1 (including) | 2.4.1-ext-1 (including) |
| Commerce | Adobe | 2.4.1-ext-2 (including) | 2.4.1-ext-2 (including) |
| Commerce | Adobe | 2.4.1-ext-3 (including) | 2.4.1-ext-3 (including) |
| Commerce | Adobe | 2.4.1-ext-4 (including) | 2.4.1-ext-4 (including) |
| Commerce | Adobe | 2.4.2 (including) | 2.4.2 (including) |
| Commerce | Adobe | 2.4.2-ext-1 (including) | 2.4.2-ext-1 (including) |
| Commerce | Adobe | 2.4.2-ext-2 (including) | 2.4.2-ext-2 (including) |
| Commerce | Adobe | 2.4.2-ext-3 (including) | 2.4.2-ext-3 (including) |
| Commerce | Adobe | 2.4.2-ext-4 (including) | 2.4.2-ext-4 (including) |
| Commerce | Adobe | 2.4.3 (including) | 2.4.3 (including) |
| Commerce | Adobe | 2.4.3-ext-1 (including) | 2.4.3-ext-1 (including) |
| Commerce | Adobe | 2.4.3-ext-2 (including) | 2.4.3-ext-2 (including) |
| Commerce | Adobe | 2.4.3-ext-3 (including) | 2.4.3-ext-3 (including) |
| Commerce | Adobe | 2.4.3-ext-4 (including) | 2.4.3-ext-4 (including) |
| Commerce | Adobe | 2.4.4 (including) | 2.4.4 (including) |
| Commerce | Adobe | 2.4.4-p1 (including) | 2.4.4-p1 (including) |
| Commerce | Adobe | 2.4.4-p2 (including) | 2.4.4-p2 (including) |
| Commerce | Adobe | 2.4.4-p3 (including) | 2.4.4-p3 (including) |
| Commerce | Adobe | 2.4.4-p4 (including) | 2.4.4-p4 (including) |
| Commerce | Adobe | 2.4.4-p5 (including) | 2.4.4-p5 (including) |
| Commerce | Adobe | 2.4.4-p6 (including) | 2.4.4-p6 (including) |
| Commerce | Adobe | 2.4.5 (including) | 2.4.5 (including) |
| Commerce | Adobe | 2.4.5-p1 (including) | 2.4.5-p1 (including) |
| Commerce | Adobe | 2.4.5-p2 (including) | 2.4.5-p2 (including) |
| Commerce | Adobe | 2.4.5-p3 (including) | 2.4.5-p3 (including) |
| Commerce | Adobe | 2.4.5-p4 (including) | 2.4.5-p4 (including) |
| Commerce | Adobe | 2.4.5-p5 (including) | 2.4.5-p5 (including) |
| Commerce | Adobe | 2.4.6 (including) | 2.4.6 (including) |
| Commerce | Adobe | 2.4.6-p1 (including) | 2.4.6-p1 (including) |
| Commerce | Adobe | 2.4.6-p2 (including) | 2.4.6-p2 (including) |
| Commerce | Adobe | 2.4.6-p3 (including) | 2.4.6-p3 (including) |
| Commerce_webhooks | Adobe | 1.2.0 (including) | 1.4.0 (including) |
| Magento | Adobe | 2.4.4 (including) | 2.4.4 (including) |
| Magento | Adobe | 2.4.4-p1 (including) | 2.4.4-p1 (including) |
| Magento | Adobe | 2.4.4-p2 (including) | 2.4.4-p2 (including) |
| Magento | Adobe | 2.4.4-p3 (including) | 2.4.4-p3 (including) |
| Magento | Adobe | 2.4.4-p4 (including) | 2.4.4-p4 (including) |
| Magento | Adobe | 2.4.4-p5 (including) | 2.4.4-p5 (including) |
| Magento | Adobe | 2.4.4-p6 (including) | 2.4.4-p6 (including) |
| Magento | Adobe | 2.4.4-p7 (including) | 2.4.4-p7 (including) |
| Magento | Adobe | 2.4.4-p8 (including) | 2.4.4-p8 (including) |
| Magento | Adobe | 2.4.5 (including) | 2.4.5 (including) |
| Magento | Adobe | 2.4.5-p1 (including) | 2.4.5-p1 (including) |
| Magento | Adobe | 2.4.5-p2 (including) | 2.4.5-p2 (including) |
| Magento | Adobe | 2.4.5-p3 (including) | 2.4.5-p3 (including) |
| Magento | Adobe | 2.4.5-p4 (including) | 2.4.5-p4 (including) |
| Magento | Adobe | 2.4.5-p5 (including) | 2.4.5-p5 (including) |
| Magento | Adobe | 2.4.5-p6 (including) | 2.4.5-p6 (including) |
| Magento | Adobe | 2.4.5-p7 (including) | 2.4.5-p7 (including) |
| Magento | Adobe | 2.4.6 (including) | 2.4.6 (including) |
| Magento | Adobe | 2.4.6-p1 (including) | 2.4.6-p1 (including) |
| Magento | Adobe | 2.4.6-p2 (including) | 2.4.6-p2 (including) |
| Magento | Adobe | 2.4.6-p3 (including) | 2.4.6-p3 (including) |
| Magento | Adobe | 2.4.6-p4 (including) | 2.4.6-p4 (including) |
| Magento | Adobe | 2.4.6-p5 (including) | 2.4.6-p5 (including) |
| Magento | Adobe | 2.4.7-b1 (including) | 2.4.7-b1 (including) |