CVE-2023-23617: DoS vulnerability in MaliciousCode filter
4.9
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.33123%
CWE
Published
1/27/2023
Updated
1/28/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openmage/magento-lts | composer | < 19.4.22 | 19.4.22 |
| openmage/magento-lts | composer | >= 20.0.0, < 20.0.19 | 20.0.19 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The commit diff explicitly modifies the filter() method's loop structure, replacing the $result variable with direct modification of $value. The original code's loop logic (using $result to store intermediate states) could cause infinite loops when preg_replace() matches persisted across iterations despite no effective sanitization progress. The CWE-835 classification and patch context confirm this was the root cause.