CVE-2023-29287: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. The vulnerability was disclosed in June 2023 and affects multiple versions of Adobe Commerce and Magento Open Source platforms (NVD, Adobe Advisory).

The vulnerability is classified as an Information Exposure issue (CWE-200) that could potentially lead to security feature bypass. It has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in low confidentiality impact (Adobe Advisory).

The vulnerability could allow an attacker to leak minor user data and bypass security features. The attack vector is network-accessible and does not require user interaction for exploitation (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Commerce and Magento Open Source installations to the latest patched versions (Adobe Advisory).