Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:* | ||
2.4.4CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.