CVE-2023-38220

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-38220
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38220.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-38220
Aliases
Published
2023-10-13T06:15:13.275Z
Modified
2026-05-28T04:09:41.392190533Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Full page cache enumeration via cookie X-Magento-Vary
Details

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.4.7-beta1"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38220.json",
    "cna_assigner": "adobe"
}
References

Affected packages

Git / github.com/magento/magento2

Affected ranges

Type
GIT
Repo
https://github.com/magento/magento2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0f9a056c8d83c4f319626b3e56ec52a533999f25
Last affected
5548bc64b5bc904346c0af9193a7fbb5274b4efa
Last affected
ef922155dbe6321862b3811e2472f2790489e685
Last affected
e18651b120784046b22e146ca1ab5d79493ed8a4
Last affected
1df4565907d40f14ee1c753cc2de2ce567bfa8d7
Last affected
11846a1a10539470f2fe1522030ff42d62daa562
Last affected
3e26248d2ccb4b52d75e6188bb1fc93dd691c254
Last affected
58dfc61e7b545bdeaf3c3a2dac489e8770d85656
Last affected
4d4e0e2ebf249a00c5f5aa1eaec3f24575133b62
Last affected
d846142a3ab8b49597dfb8bd7508d875efdab19a
Last affected
727560d82199f6b938d1906e9d923e2dd40b490a
Last affected
37861a4025ef7f18016d3ab149e006da46821784
Last affected
d10435b11ada4e502dca7539f8fd31d059d3c482
Database specific 
{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-NA"
        },
        {
            "last_affected": "2.4.4-p1"
        },
        {
            "last_affected": "2.4.4-p2"
        },
        {
            "last_affected": "2.4.4-p3"
        },
        {
            "last_affected": "2.4.5-NA"
        },
        {
            "last_affected": "2.4.5-p1"
        },
        {
            "last_affected": "2.4.5-p2"
        },
        {
            "last_affected": "2.4.5-p3"
        },
        {
            "last_affected": "2.4.5-p4"
        },
        {
            "last_affected": "2.4.6-NA"
        },
        {
            "last_affected": "2.4.6-p1"
        },
        {
            "last_affected": "2.4.6-p2"
        },
        {
            "last_affected": "2.4.7-b1"
        }
    ]
}

Affected versions

0.*
0.1.0-alpha100
0.1.0-alpha101
0.1.0-alpha102
0.1.0-alpha103
0.1.0-alpha104
0.1.0-alpha105
0.1.0-alpha106
0.1.0-alpha107
0.1.0-alpha108
0.1.0-alpha89
0.1.0-alpha90
0.1.0-alpha91
0.1.0-alpha92
0.1.0-alpha93
0.1.0-alpha94
0.1.0-alpha95
0.1.0-alpha96
0.1.0-alpha97
0.1.0-alpha98
0.1.0-alpha99
0.42.0-beta1
0.42.0-beta3
0.74.0-beta1
2.*
2.0.0
2.0.0-rc
2.1.0
2.1.0-rc1
2.1.0-rc2
2.1.0-rc3
2.2.0-RC1.1
2.2.0-RC1.2
2.2.0-RC1.3
2.4.4
2.4.4-p1
2.4.4-p2
2.4.4-p3
2.4.5
2.4.5-p1
2.4.5-p2
2.4.5-p3
2.4.5-p4
2.4.6
2.4.6-p1
2.4.6-p2
2.4.7-p1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-38220.json"