CVE-2023-29297:
Magento Open Source allows Improper Neutralization of Special Elements Used
9.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.90404%
CWE
Published
6/15/2023
Updated
3/4/2025
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
magento/community-edition | composer | = 2.4.6 | |
magento/community-edition | composer | = 2.4.5 | |
magento/community-edition | composer | = 2.4.4 | |
magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p3 | 2.4.5-p3 |
magento/community-edition | composer | >= 2.4.4-p1, < 2.4.4-p4 | 2.4.4-p4 |
magento/project-community-edition | composer | <= 2.0.2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability (CWE-1336) explicitly involves improper neutralization in template engines. Magento's core templating system relies on PHP-based template rendering. Admin users with template editing privileges could inject malicious code into templates processed by these functions.
getProcessedTemplate
is a known high-risk function in email template handling, where variables like{{css ...}}
or{{inlinecss ...}}
might allow PHP code execution if input isn't sanitized.fetchView
directly evaluates template files, and if an attacker controls the template content/path (e.g., via CMS block edits), it could lead to arbitrary code execution. These functions align with the CWE's focus on template engine vulnerabilities and the attack vector described (admin-triggered RCE).