CVE-2023-23617 affects OpenMage LTS e-commerce platform versions prior to 19.4.22 and 20.0.19, where a malicious code filter can enter an infinite loop under specific conditions. This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity that can lead to high availability impact, effectively causing a denial of service. There are no known workarounds, and while the EPSS score is low, suggesting a low probability of exploitation, there is currently no public exploit code available, nor is it listed in CISA's KEV catalog or experiencing significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 19.4.22CPE matchmatch criteria | cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* | ||
>= 20.0.0, < 20.0.19CPE matchmatch criteria | cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.