CVE-2023-29297: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, identified as CVE-2023-29297. The vulnerability was discovered and reported to Adobe Systems Incorporated, with the CVE being created on April 4, 2023 (CVE MITRE).

The vulnerability is classified as a template engine security issue that could potentially lead to arbitrary code execution. It has received a CVSS v3.1 base score of 7.2 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, while Adobe Systems rated it with a score of 9.1 (CRITICAL) with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability could lead to arbitrary code execution when exploited by an attacker with administrative privileges. The impact is considered severe as it affects confidentiality, integrity, and availability of the system, all rated as High in the CVSS scoring (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Commerce installations to the latest version that includes the security fix (Adobe Advisory).