CVE-2023-22247: 
PHP vulnerability analysis and mitigation

CVE-2023-22247 is an XML Injection vulnerability affecting Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier). The vulnerability was disclosed on March 14, 2023, and could lead to arbitrary file system read. This security flaw affects both Adobe Commerce and Magento Open Source platforms (Adobe Advisory).

The vulnerability is classified as an XML Injection (also known as Blind XPath Injection) with a CVSS v3.1 Base Score of 7.5 (High). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U) with high impact on confidentiality (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

The vulnerability allows an unauthenticated attacker to force the application to make arbitrary requests via injection of arbitrary URLs, potentially leading to unauthorized file system read access. This could result in exposure of sensitive information stored in the system (NVD).

Adobe has released security updates to address this vulnerability. Users should upgrade Adobe Commerce to version 2.4.4-p3 or 2.4.5-p2 or later. The same applies to Magento Open Source installations (Adobe Advisory).