Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Commerce | Adobe | 2.4.4 (including) | 2.4.4 (including) |
| Commerce | Adobe | 2.4.4-p1 (including) | 2.4.4-p1 (including) |
| Commerce | Adobe | 2.4.4-p10 (including) | 2.4.4-p10 (including) |
| Commerce | Adobe | 2.4.4-p2 (including) | 2.4.4-p2 (including) |
| Commerce | Adobe | 2.4.4-p3 (including) | 2.4.4-p3 (including) |
| Commerce | Adobe | 2.4.4-p4 (including) | 2.4.4-p4 (including) |
| Commerce | Adobe | 2.4.4-p5 (including) | 2.4.4-p5 (including) |
| Commerce | Adobe | 2.4.4-p6 (including) | 2.4.4-p6 (including) |
| Commerce | Adobe | 2.4.4-p7 (including) | 2.4.4-p7 (including) |
| Commerce | Adobe | 2.4.4-p8 (including) | 2.4.4-p8 (including) |
| Commerce | Adobe | 2.4.4-p9 (including) | 2.4.4-p9 (including) |
| Commerce | Adobe | 2.4.5 (including) | 2.4.5 (including) |
| Commerce | Adobe | 2.4.5-p1 (including) | 2.4.5-p1 (including) |
| Commerce | Adobe | 2.4.5-p2 (including) | 2.4.5-p2 (including) |
| Commerce | Adobe | 2.4.5-p3 (including) | 2.4.5-p3 (including) |
| Commerce | Adobe | 2.4.5-p4 (including) | 2.4.5-p4 (including) |
| Commerce | Adobe | 2.4.5-p5 (including) | 2.4.5-p5 (including) |
| Commerce | Adobe | 2.4.5-p6 (including) | 2.4.5-p6 (including) |
| Commerce | Adobe | 2.4.5-p7 (including) | 2.4.5-p7 (including) |
| Commerce | Adobe | 2.4.5-p8 (including) | 2.4.5-p8 (including) |
| Commerce | Adobe | 2.4.5-p9 (including) | 2.4.5-p9 (including) |
| Commerce | Adobe | 2.4.6 (including) | 2.4.6 (including) |
| Commerce | Adobe | 2.4.6-p1 (including) | 2.4.6-p1 (including) |
| Commerce | Adobe | 2.4.6-p2 (including) | 2.4.6-p2 (including) |
| Commerce | Adobe | 2.4.6-p3 (including) | 2.4.6-p3 (including) |
| Commerce | Adobe | 2.4.6-p4 (including) | 2.4.6-p4 (including) |
| Commerce | Adobe | 2.4.6-p5 (including) | 2.4.6-p5 (including) |
| Commerce | Adobe | 2.4.6-p6 (including) | 2.4.6-p6 (including) |
| Commerce | Adobe | 2.4.6-p7 (including) | 2.4.6-p7 (including) |
| Commerce | Adobe | 2.4.7 (including) | 2.4.7 (including) |
| Commerce | Adobe | 2.4.7-b1 (including) | 2.4.7-b1 (including) |
| Commerce | Adobe | 2.4.7-b2 (including) | 2.4.7-b2 (including) |
| Commerce | Adobe | 2.4.7-p1 (including) | 2.4.7-p1 (including) |
| Commerce | Adobe | 2.4.7-p2 (including) | 2.4.7-p2 (including) |
| Commerce_b2b | Adobe | 1.3.3 (including) | 1.3.3 (including) |
| Commerce_b2b | Adobe | 1.3.3-p10 (including) | 1.3.3-p10 (including) |
| Commerce_b2b | Adobe | 1.3.4 (including) | 1.3.4 (including) |
| Commerce_b2b | Adobe | 1.3.4-p9 (including) | 1.3.4-p9 (including) |
| Commerce_b2b | Adobe | 1.3.5 (including) | 1.3.5 (including) |
| Commerce_b2b | Adobe | 1.3.5-p7 (including) | 1.3.5-p7 (including) |
| Commerce_b2b | Adobe | 1.4.2 (including) | 1.4.2 (including) |
| Commerce_b2b | Adobe | 1.4.2-p1 (including) | 1.4.2-p1 (including) |
| Commerce_b2b | Adobe | 1.4.2-p2 (including) | 1.4.2-p2 (including) |
| Magento | Adobe | 2.4.4 (including) | 2.4.4 (including) |
| Magento | Adobe | 2.4.4-p1 (including) | 2.4.4-p1 (including) |
| Magento | Adobe | 2.4.4-p10 (including) | 2.4.4-p10 (including) |
| Magento | Adobe | 2.4.4-p2 (including) | 2.4.4-p2 (including) |
| Magento | Adobe | 2.4.4-p3 (including) | 2.4.4-p3 (including) |
| Magento | Adobe | 2.4.4-p4 (including) | 2.4.4-p4 (including) |
| Magento | Adobe | 2.4.4-p5 (including) | 2.4.4-p5 (including) |
| Magento | Adobe | 2.4.4-p6 (including) | 2.4.4-p6 (including) |
| Magento | Adobe | 2.4.4-p7 (including) | 2.4.4-p7 (including) |
| Magento | Adobe | 2.4.4-p8 (including) | 2.4.4-p8 (including) |
| Magento | Adobe | 2.4.4-p9 (including) | 2.4.4-p9 (including) |
| Magento | Adobe | 2.4.5 (including) | 2.4.5 (including) |
| Magento | Adobe | 2.4.5-p1 (including) | 2.4.5-p1 (including) |
| Magento | Adobe | 2.4.5-p2 (including) | 2.4.5-p2 (including) |
| Magento | Adobe | 2.4.5-p3 (including) | 2.4.5-p3 (including) |
| Magento | Adobe | 2.4.5-p4 (including) | 2.4.5-p4 (including) |
| Magento | Adobe | 2.4.5-p5 (including) | 2.4.5-p5 (including) |
| Magento | Adobe | 2.4.5-p6 (including) | 2.4.5-p6 (including) |
| Magento | Adobe | 2.4.5-p7 (including) | 2.4.5-p7 (including) |
| Magento | Adobe | 2.4.5-p8 (including) | 2.4.5-p8 (including) |
| Magento | Adobe | 2.4.5-p9 (including) | 2.4.5-p9 (including) |
| Magento | Adobe | 2.4.6 (including) | 2.4.6 (including) |
| Magento | Adobe | 2.4.6-p1 (including) | 2.4.6-p1 (including) |
| Magento | Adobe | 2.4.6-p2 (including) | 2.4.6-p2 (including) |
| Magento | Adobe | 2.4.6-p3 (including) | 2.4.6-p3 (including) |
| Magento | Adobe | 2.4.6-p4 (including) | 2.4.6-p4 (including) |
| Magento | Adobe | 2.4.6-p5 (including) | 2.4.6-p5 (including) |
| Magento | Adobe | 2.4.6-p6 (including) | 2.4.6-p6 (including) |
| Magento | Adobe | 2.4.6-p7 (including) | 2.4.6-p7 (including) |
| Magento | Adobe | 2.4.7 (including) | 2.4.7 (including) |
| Magento | Adobe | 2.4.7-b1 (including) | 2.4.7-b1 (including) |
| Magento | Adobe | 2.4.7-p1 (including) | 2.4.7-p1 (including) |
| Magento | Adobe | 2.4.7-p2 (including) | 2.4.7-p2 (including) |