helpx.adobe.com
Open in
urlscan Pro
104.124.11.35
Public Scan
URL:
https://helpx.adobe.com/security/products/magento/apsb22-38.html
Submission: On December 05 via api from IN — Scanned from DE
Submission: On December 05 via api from IN — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
* * * * Adobe
* * * Creativity & Design Creativity Creativity & Design
* * * * What is Creative Cloud? Creative apps and services
for everyone
* * Photographers Lightroom, Photoshop, and more
* Students and teachers Save over 60% on Creative
Cloud
* Individuals 20+ creative apps, Acrobat, and more
* Business Solutions for teams and enterprises
* Schools and universities Simple administration and
licensing
* View plans and pricing Simple administration and
licesing
* Featured products
* Photoshop Image editing and design
* Adobe Express All-in-one design, video, photo, and
PDF app
* Lightroom Photo editing and organization
* Illustrator Vector graphics and illustration
* Premiere Pro Video editing and production
* Adobe Stock High-quality licensable assets
* View all products
* * Explore
* Photo
* Graphic design
* Video
* Illustration
* Social media
* 3D & AR
* PDF
* New releases
* Adobe Firefly AI-powered content creation
* * *
* * Find the perfect app in about 60 seconds.
* Get started
* PDF & E-signatures
* * * Products
* Adobe Acrobat The complete PDF solution
* Acrobat plans and pricing
* Adobe Acrobat Sign The complete e-signature
solution
* E-signature plans and pricing
* Acrobat Reader View, scan, and annotate PDFs
* View all products
* * Shop for
* Business
* Students & Teachers
* Home & Personal
* Government
* * Online Tools
* PDF to Word
* Compress PDF
* Merge PDF
* Word to PDF
* View all tools
* Business Resources
* Developer resources
* E-signature tutorials
* Events & Webinars
* Articles & reports
* * * Acrobat Pro
* Create, edit, and sign documents with our
all-in-one PDF and e-signature solution.
Start free trial
* Marketing & Commerce
* * * * Adobe Experience Cloud
* Solutions
* Data insights and audiences
* Personalized insights & engagement
* Content management
* Content supply chain
* Commerce
* Customer journeys
* B2B marketing
* Request a demo
* * Products
* Analytics
* Real-Time CDP
* Marketo Engage
* Commerce (Magento)
* Workfront
* Customer Journey Analytics
* Product Analytics
* Journey Optimizer
* Experience Manager Sites (CMS)
* Experience Manager Assets (DAM)
* View all products
* * * Artificial Intelligence
* Sensei
* Sensei GenAI
* Resources
* Resource center
* Customer success stories
* * Support
* Services and support
* Training
* Help documentation
* Partners
* Events
* Adobe Summit
* Help & Support
* * Help and support
* Help Center Troubleshooting and how-tos
* Enterprise Support Dedicated help for large
organizations
* Adobe Support Community
* Download and install
* Contact us
* Common tasks
* Manage my account
* Manage my plan
* Learning resources
* Creative Cloud tutorials Learn with tutorials
designed to inspire
* Adobe Express Quick videos to start a project
* Acrobat tutorials Learn the basics or refine your
skills
* Adobe Experience League Personalized learning to
develop your skills
* * *
* * Make social content and more with Adobe Express
video tutorials.
* Get started
* Adobe
* * Sign In
*
*
ADOBE SECURITY BULLETIN
Search
Last updated on Oct 18, 2022
Security update available for Adobe Commerce | APSB22-38
Bulletin ID
Date Published
Priority
APSB22-38
August 9, 2022
3
SUMMARY
Adobe has released a security update for Adobe Commerce and Magento Open Source.
This update resolves critical, important and moderate vulnerabilities.
Successful exploitation could lead to arbitrary code execution, privilege
escalation and security feature bypass.
AFFECTED VERSIONS
Product Version Platform Adobe Commerce 2.4.3-p2 and earlier versions
All 2.3.7-p3 and earlier versions All
Adobe Commerce
2.4.4 and earlier versions
All
Magento Open Source
2.4.3-p2 and earlier versions
All 2.3.7-p3 and earlier versions All Magento Open Source
2.4.4 and earlier versions
All
SOLUTION
Adobe categorizes these updates with the following priority ratings and
recommends users update their installation to the newest version.
Product Updated Version Platform Priority Rating Installation Instructions Adobe
Commerce
2.3.7-p4, 2.4.3-p3, 2.4.4-p1, 2.4.5
All
3
2.4.x release notes
2.3.x release notes
Magento Open Source
2.3.7-p4, 2.4.3-p3, 2.4.4-p1, 2.4.5
All
3
VULNERABILITY DETAILS
Vulnerability Category Vulnerability Impact Severity Authentication required to
exploit? Exploit requires admin privileges?
CVSS base score
CVSS vector
Magento Bug ID CVE number(s) XML Injection (aka Blind XPath Injection) (CWE-91)
Arbitrary code execution
Critical Yes Yes 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
PRODSECBUG-3095
CVE-2022-34253
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
(CWE-22)
Arbitrary code execution
Critical Yes No 8.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
PRODSECBUG-3081
CVE-2022-34254
Improper Input Validation (CWE-20)
Privilege escalation
Critical Yes No 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
PRODSECBUG-3082
CVE-2022-34255
Improper Authorization (CWE-285)
Privilege escalation
Critical No No 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
PRODSECBUG-3093
CVE-2022-34256
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important No No 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PRODSECBUG-3079
CVE-2022-34257
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Moderate Yes Yes 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
PRODSECBUG-3080
CVE-2022-34258
Improper Access Control (CWE-284)
Security feature bypass
Important No No 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
PRODSECBUG-3180
CVE-2022-34259
Improper Authorization (CWE-285)
Security feature bypass
Moderate
No No 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
PRODSECBUG-3151
CVE-2022-35692
Improper Input Validation (CWE-20)
Privilege escalation
Critical Yes No 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PRODSECBUG-3196
CVE-2022-42344
ACKNOWLEDGEMENTS
Adobe would like to thank the following researchers for reporting this issue and
working with Adobe to help protect our customers:
* zb3 (zb3) -- CVE-2022-34253, CVE-2022-34255, CVE-2022-34256
* Edgar Boda-Majer (eboda) - CVE-2022-34254, CVE-2022-34257
* Salman Khan (salmanbabuzai) - CVE-2022-34258
* Axel Flamcourt (axfla) - CVE-2022-34259, CVE-2022-35692
* fqdn - CVE-2022-42344
REVISIONS
October 18, 2022: Added CVE-2022-42344
August 22, 2022: Priority rating revision in Solution table
August 18, 2022: Added CVE-2022-35692
August 12, 2022: Updated values in "Authentication required to exploit" and
"Exploit requires admin privileges."
--------------------------------------------------------------------------------
For more information, visit https://helpx.adobe.com/security.html, or email
PSIRT@adobe.com.
Sign in to your account
Sign in
Manage account
Quick links
View all your plans Manage your plans
Share this page
*
*
*
* Link copied
Was this page helpful?
Yes, thanks
Not really
ASK THE COMMUNITY
Post questions and get answers from experts.
Ask now
CONTACT US
Real help from real people.
Start now
^ Back to top
* * * Shop for
* Creative Cloud
* Photoshop
* Adobe Express
* Photography
* Premiere Pro
* Adobe Stock
* Elements Family
* Document Cloud
* Acrobat
* Acrobat Sign
* Special offers
* View plans and pricing
* View all products
* * * For business
* Creative Cloud for business
* Creative Cloud for enterprise
* Acrobat for business
* * For education
* Discounts for students and teachers
* Schools and universities
* Digital Learning Solutions
* * For mobile
* Apps for iOS
* Apps for Android
* * Experience Cloud
* What is Experience Cloud?
* Analytics
* Experience Manager
* Commerce
* Marketo Engage
* Workfront
* Terms of Use
* * * Support
* Download and install
* Help Center
* Adobe Support Community
* Enterprise Support
* Genuine software
* * Resources
* Adobe Blog
* Adobe Developer
* * Adobe Account
* Log in to your account
* * Adobe
* About
* Careers
* Newsroom
* Corporate responsibility
* Investor Relations
* Supply chain
* Trust Center
* Events
* Diversity and inclusion
* Integrity
* * Featured products
* Adobe Acrobat Reader
* Adobe Express
* Photoshop
* Illustrator
* * * Change region
* *
*
*
*
* Copyright © 2023 Adobe. All rights reserved.
* Privacy
* Terms of Use
* Cookie preferences
* Do not sell or share my personal information
* AdChoices
Language Navigation
Language Navigation
Choose a region
Selecting a region changes the language and/or content on Adobe.com.
* Americas
* Brasil
* Canada - English
* Canada - Français
* Latinoamérica
* México
* Argentina
* Colombia
* Perú
* Chile
* United States
* Asia Pacific
* Australia
* Hong Kong S.A.R. of China
* India - English
* Indonesia - English
* Malaysia - English
* New Zealand
* Philippines - English
* Vietnam - English
* 中国
* 中國香港特別行政區
* 台灣地區
* 日本
* Indonesia
* Malaysia
* Pilipinas
* Việt Nam
* भारत
* 한국
* Singapore
* Thailand - English
* ประเทศไทย
* Europe, Middle East and Africa
* Africa - English
* België - Nederlands
* Belgique - Français
* Belgium - English
* Česká republika
* Cyprus - English
* Danmark
* Deutschland
* Eesti
* España
* France
* Greece - English
* Ireland
* Israel - English
* Italia
* Latvija
* Lietuva
* Luxembourg - Deutsch
* Luxembourg - English
* Luxembourg - Français
* Magyarország
* Malta - English
* Middle East and North Africa - English
* Nederland
* Norge
* Österreich
* Polska
* Portugal
* România
* Schweiz
* Slovenija
* Slovensko
* Suisse
* Suomi
* Svizzera
* Türkiye
* United Kingdom
* България
* Россия
* Україна
* الشرق الأوسط وشمال أفريقيا - اللغة العربية
* ישראל - עברית
* Sverige
* Saudi Arabia - English
* United Arab Emirates - English
* الإمارات العربية المتحدة
* المملكة العربية السعودية
Locale Modal
We have detected you are visiting a different region on adobe.com
Sie befinden sich außerhalb der USA? Auf der Adobe-Website für Ihre Region
finden Sie Informationen zu den für Sie relevanten Preisen, Angeboten und
Veranstaltungen.
Are you visiting adobe.com from outside your region? Visit your regional site
for more relevant pricing, promotions and events.
Zur Website für DeutschlandContinue to United States
MAKE IT YOUR OWN
Adobe and its vendors use cookies and similar technologies to improve your
experience and measure your interactions with our websites, products and
services. We also use them to provide you more relevant information in searches
and in ads on this and other sites. If that’s okay, click “Enable all". Clicking
“Don’t enable” will set only cookies that are strictly necessary. You can also
view our vendors and customize your choices by clicking "Cookie Settings".
Cookie Settings Don't Enable Enable all
COOKIE SETTINGS
Don’t enable Enable all Confirm my choices
GENERAL INFORMATION
* You are in control of your data.
You can control how Adobe websites use cookies and similar technologies by
making choices below. But note that if you disable cookies and similar
technologies entirely, Adobe websites may not function properly.
* What are cookies and why does Adobe use them?
Cookies are small text files stored by your web browser when you use
websites. There are also other technologies that can be used for similar
purposes like HTML5 Local Storage and local shared objects, web beacons, and
embedded scripts. These technologies help us do things like remembering you
and your preferences when you return to our sites, measure how you use the
website, conduct market research, and gather information about the ads you
see and interact with.
* How do I make choices?
You can make choices in the menu below about what cookies and other
technologies you want us to use on Adobe sites when you visit them from this
browser. You can always change those choices later by clicking on the Cookie
Preferences link at the bottom of the page.
IF ENABLED:
* We can improve your experience by tailoring the site and the content to
things we think might be of interest
* We can better keep track of your preferences — like what language you prefer
to use
* We will better understand your likely interests so we can provide you more
relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
* It will help us improve the performance of our website and those of our
partners who use the Adobe Experience Cloud
IF DISABLED:
* We won’t be able to remember you from session to session so the experience
may not be tailored to your interests
* You’ll still have access to the content of the site but certain features that
depend on cookies may not function
* You’ll still see ads, they just may not be as relevant to you
Enable all
OPERATE THE SITE AND CORE SERVICES
Always active
Operate the site and core services
These cookies are required, and they are used to enable the site and related
services core functionality. Without them the site could not operate, so they
cannot be disabled.
Cookie details
MEASURE PERFORMANCE
Measure performance
These cookies are used to analyze site usage to measure and improve performance.
Without them Adobe cannot know what content is most valued and how often unique
visitors return to the site, making it hard to improve information we offer to
you.
Cookie details
EXTEND FUNCTIONALITY
Extend functionality
These cookies are used to enhance the functionality of Adobe sites such as
remembering your settings and preferences to deliver a personalized experience;
for example, your username, your repeated visits, preferred language, your
country, or any other saved preference.
Cookie details
PERSONALIZE ADVERTISING
Personalize advertising
These cookies are used to enable Adobe and our partners to serve ads more
relevant to your interests. Without them you will still see ads, but they might
not be as relevant to you.
Cookie details
Confirm my choices
Back Button
Back
PERFORMANCE COOKIES
Vendor Search Search Icon Filter Icon
Clear Filters
Information storage and access
Apply
Consent Leg.Interest
All Consent Allowed
Select All Vendors
Select All Vendors
All Consent Allowed
* HOST DESCRIPTION
View Cookies
REPLACE-WITH-DYANMIC-HOST-ID
* Name
cookie name
Confirm my choices
Chat with us