CVE-2023-38207: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an XML Injection (aka Blind XPath Injection) vulnerability identified as CVE-2023-38207. The vulnerability was discovered and disclosed in August 2023, with Adobe releasing security updates to address the issue. This vulnerability does not require user interaction for exploitation (NVD).

The vulnerability is classified as an XML Injection (CWE-91) with a CVSS v3.1 base score of 7.5 (HIGH). The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U) with high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

If successfully exploited, this vulnerability could lead to minor arbitrary file system read access on affected systems (Adobe Advisory).

Adobe has released security updates to address this vulnerability. Users should update to Adobe Commerce versions 2.4.6-p2 (for 2.4.6 and earlier), 2.4.5-p4 (for 2.4.5-p3 and earlier), or 2.4.4-p5 (for 2.4.4-p3 and earlier) (Lansweeper).