CVE-2022-34253
Adobe Commerce XML Injection Arbitrary code execution
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Adobe Commerce XML Injection Arbitrary code execution
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
- Record
CVE-2022-34253- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
EUVDEUVD-2022-6539
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
- Record
EUVD-2022-6539- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cj7w-pm77-hvg6
Magento XML Injection vulnerability in the Widgets Module
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
- Record
GHSA-cj7w-pm77-hvg6- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
NVD
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
- Record
CVE-2022-34253- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
OSV
Adobe Commerce XML Injection Arbitrary code execution
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
- Record
CVE-2022-34253- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
OSVGHSA-cj7w-pm77-hvg6
Magento XML Injection vulnerability in the Widgets Module
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
- Record
GHSA-cj7w-pm77-hvg6- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
OSVBIT-magento-2022-34253 No score
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
- Record
BIT-magento-2022-34253- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist |
before 2.3.7-p4 | 2.3.7-p4 |
magento/community-editionPackagist |
2.4.4 up to 2.4.5 | 2.4.5 |
magento/community-editionPackagist |
2.4.0 up to 2.4.3-p3 | 2.4.3-p3 |
magentoBitnami |
2.3.0 up to 2.3.7, 2.4.0 up to 2.4.3, 2.3.7-p1 to 2.3.7-p1, 2.3.7-p2 to 2.3.7-p2, 2.3.7-p3 to 2.3.7-p3, 2.3.7 to 2.3.7, 2.4.3-p1 to 2.4.3-p1, 2.4.3-p2 to 2.4.3-p2, 2.4.3 to 2.4.3, 2.4.4 to 2.4.4 | 2.3.72.4.3 |
magento/community-editionPackagist |
before 2.3.7-p4, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3 |
2.3.7-p4 |
magento/community-editionPackagist |
2.4.4 up to 2.4.5, plus listed versions 2.4.4-p12.4.4-p102.4.4-p112.4.4-p122.4.4-p13 Show 8 moreShow less2.4.4-p22.4.4-p32.4.4-p42.4.4-p52.4.4-p62.4.4-p72.4.4-p82.4.4-p9 |
2.4.5 |
magento/community-editionPackagist |
2.4.0 up to 2.4.3-p3, plus listed versions 2.4.0-p12.4.12.4.1-p12.4.22.4.2-p1 Show 4 moreShow less2.4.2-p22.4.32.4.3-p12.4.3-p2 |
2.4.3-p3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-34253 is a critical vulnerability (CVSS 9.1) in Adobe Commerce, published August 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.16%, the 92nd percentile. Fixed in magento/community-edition 2.3.7-p4.
References
helpx.adobe.com/security/products/magento/apsb22-38.html
nvd.nist.gov/vuln/detail/CVE-2022-34253
github.com/magento/magento2/commit/246d524b7586af2245092008e0d92b8d6fdd8523
Left out here: 75 versions. The JSON record has them.