CVE-2022-34253: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier), and 2.4.4 (and earlier) are affected by an XML Injection vulnerability (CVE-2022-34253) in the Widgets Module. The vulnerability was disclosed on June 21, 2022, and affects both Adobe Commerce and Magento Open Source platforms (CVE Details, Adobe Security).

The vulnerability is classified as an XML Injection (also known as Blind XPath Injection) vulnerability with a critical CVSS base score of 9.1. The issue resides in the Widgets Module of the affected software versions, where improper handling of XML input could lead to remote code execution (Lansweeper).

If successfully exploited, this vulnerability allows an attacker with admin privileges to execute remote code on the affected system. The exploitation does not require user interaction, making it particularly dangerous for systems where admin access is compromised (NVD).

Adobe has released patches to address this vulnerability. Users are advised to update to versions 2.3.7-p4, 2.4.3-p3, 2.4.4-p1, or 2.4.5, depending on their current installation version (Lansweeper).