{"id":"CVE-2023-23617","aliases":["EUVD-2023-0323","GHSA-3p73-mm7v-4f6m"],"status":"published","title":"OpenMage LTS has DoS vulnerability in MaliciousCode filter","description":"OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01031,"percentile":0.64022,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2023-01-27T00:55:11Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"Packagist","package":"openmage/magento-lts","fixed_in":["19.4.22","20.0.19"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4.22"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.0.19"}]}]},{"source":"osv","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4.22"}]}],"versions":["1.9.1.1","1.9.2.0","1.9.2.1","1.9.2.2","1.9.2.3","1.9.2.4","1.9.3.0","1.9.3.1","v19.4.0","v19.4.1","v19.4.10","v19.4.11","v19.4.12","v19.4.13","v19.4.14","v19.4.15","v19.4.16","v19.4.17","v19.4.18","v19.4.19","v19.4.2","v19.4.20","v19.4.21","v19.4.3","v19.4.4","v19.4.5","v19.4.6","v19.4.7","v19.4.8","v19.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.0.19"}]}],"versions":["v20.0.0","v20.0.1","v20.0.10","v20.0.11","v20.0.12","v20.0.13","v20.0.14","v20.0.15","v20.0.16","v20.0.17","v20.0.18","v20.0.2","v20.0.3","v20.0.4","v20.0.5","v20.0.6","v20.0.7","v20.0.8"]}],"products":[{"vendor":"openmage","product":"magento"},{"vendor":"openmage","product":"magento-lts"}],"references":[{"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3p73-mm7v-4f6m","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/OpenMage/magento-lts/commit/494027785bdb7db53e60c11ef03c144b61cd3172","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23617","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3p73-mm7v-4f6m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23617.json","tags":["advisory"]},{"url":"https://github.com/OpenMage/magento-lts","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-23617","title":"OpenMage LTS has DoS vulnerability in MaliciousCode filter","description":"OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.","status":"published","published":"2023-01-27T23:24:33.249Z","modified":"2025-03-10T21:18:07.687Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:35:21.232549Z"}],"euvd":[{"id":"EUVD-2023-0323","description":"OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.","status":"published","published":"2023-01-27T23:24:33Z","modified":"2025-03-10T21:18:07Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:08.584552Z"}],"ghsa":[{"id":"GHSA-3p73-mm7v-4f6m","title":" DoS vulnerability in MaliciousCode filter","description":"### Impact\nInfinite loop in malicious code filter in certain conditions.\n\n### Workarounds\n\nNone","status":"published","published":"2023-01-27T00:55:11Z","modified":"2023-01-28T00:31:26Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:36:22.592333Z"}],"nvd":[{"id":"CVE-2023-23617","description":"OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.","status":"published","published":"2023-01-28T00:15:09.173Z","modified":"2026-06-17T05:37:35.657Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-23617","title":"OpenMage LTS has DoS vulnerability in MaliciousCode filter","description":"OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.","status":"published","published":"2023-01-27T23:24:33.249Z","modified":"2026-10-28T02:30:24.141916558Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-3p73-mm7v-4f6m","title":" DoS vulnerability in MaliciousCode filter","description":"### Impact\nInfinite loop in malicious code filter in certain conditions.\n\n### Workarounds\n\nNone","status":"published","published":"2023-01-27T00:55:11Z","modified":"2026-09-10T03:49:50.74119959Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}