# Affected Range Ending at 2.4.2 CVEs with an affected range that ends at version 2.4.2 (inclusive). Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-cpe-version-end-including/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs with an affected range that ends at version 2.4.2 (inclusive). Example 8 of 14 in **Filters › Affected Products (CPE)** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.cpe.version_end_including` · `operator` `eq` `enrichment.cpe.version_end_including` is the last affected version (inclusive). `eq` matches the exact value `2.4.2`. In the response, look at `results[].enrichment.cpe[].version_end_including`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.cpe.version_end_including` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `2.4.2` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.cpe.version_end_including", "type": "eq", "value": "2.4.2" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].configurations[].nodes[].cpe_match: first 10 items; results[].enrichment.cpe: first 10 items; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 59, "results": [ { "id": "CVE-2023-1399", "source_identifier": "user@hq.dhs.gov", "published": "2023-03-27T16:15:09Z", "last_modified": "2026-06-17T05:27:52Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "\nN6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affected device’s default configuration and achieve remote code execution." } ], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-01", "source": "user@hq.dhs.gov", "tags": [ "Third Party Advisory", "US Government Resource" ] }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-01", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@hq.dhs.gov", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "LOCAL", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 7.8, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 1.8, "impact_score": 5.9 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@hq.dhs.gov", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-502" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-502" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:keysight:n6854a_firmware:*:*:*:*:*:*:*:*", "match_criteria_id": "275BC2F4-12BD-49E6-9631-DBFEBEF51EB2", "version_start_including": null, "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:keysight:n6854a:-:*:*:*:*:*:*:*", "match_criteria_id": "685A10D5-092D-48D5-92F8-5D960A825E93", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:o:keysight:n6854a_firmware:*:*:*:*:*:*:*:*", "vendor": "keysight", "product": "n6854a_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null, "affected_versions_first": "2.3.0", "affected_versions_last": "2.4.2" }, { "criteria": "cpe:2.3:h:keysight:n6854a:-:*:*:*:*:*:*:*", "vendor": "keysight", "product": "n6854a", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 502, "owasptop10_2021": "A08 Software and Data Integrity Failures", "name": "Deserialization of Untrusted Data", "description": "The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.", "capec_id": [ 586 ], "scope": [ "Availability", "Integrity", "Other" ], "impact": [ "DoS: Resource Consumption (CPU)", "Modify Application Data", "Unexpected State", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00785, "percentile": 0.54626, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2022-24086", "source_identifier": "user@adobe.com", "published": "2022-02-16T17:15:13Z", "last_modified": "2026-06-17T04:31:16Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2022-02-15", "cisa_action_due": "2022-03-01", "cisa_required_action": "Apply updates per vendor instructions.", "cisa_vulnerability_name": "Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability", "descriptions": [ { "lang": "en", "value": "Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution." }, { "lang": "es", "value": "Adobe Commerce versiones 2.4.3-p1 (y anteriores) y 2.3.7-p2 (y anteriores), están afectadas por una vulnerabilidad de comprobación de entrada inapropiada durante el proceso de compra. Una explotación de este problema no requiere la interacción del usuario y podría resultar en una ejecución de código arbitrario" } ], "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb22-12.html", "source": "user@adobe.com", "tags": [ "Patch", "Release Notes", "Vendor Advisory" ] }, { "url": "https://helpx.adobe.com/security/products/magento/apsb22-12.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Release Notes", "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Third Party Advisory", "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@adobe.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "COMPLETE", "integrity_impact": "COMPLETE", "availability_impact": "COMPLETE", "base_score": 10.0, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 10.0, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@adobe.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-20" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "match_criteria_id": "90B19F1A-11A1-4315-8433-6B8938228BF7", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.3.0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "match_criteria_id": "CE057011-26D8-4298-8D24-624CCD26F014", "version_start_including": "2.3.3", "version_start_excluding": null, "version_end_including": "2.3.6", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "match_criteria_id": "6DFFF83C-2A52-442D-8349-7B37843B630F", "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*", "match_criteria_id": "9F471E19-8AFE-4A6C-88EA-DF94428518F7", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*", "match_criteria_id": "27E5B990-1E1C-46AC-815F-AF737D211C16", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*", "match_criteria_id": "7B503C35-8C90-4A24-8E60-722CDBBF556B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*", "match_criteria_id": "8A453C85-A14A-47B8-B91D-3906BBE42A78", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*", "match_criteria_id": "67B41B1F-86FE-43A9-BE12-42F15F47446A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.3.0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*", "match_criteria_id": "9F0EBEC1-B55D-40FE-A649-969D7B2F5BA3", "version_start_including": null, "version_start_excluding": "2.3.3", "version_end_including": "2.3.6", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*", "match_criteria_id": "59C7EB66-4DC7-40E5-AEA5-605A930E09EB", "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "vendor": "adobe", "product": "commerce", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.3.0", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "vendor": "adobe", "product": "commerce", "product_type": "a", "vulnerable": true, "version_start_including": "2.3.3", "version_start_excluding": null, "version_end_including": "2.3.6", "version_end_excluding": null, "affected_versions_first": "2.3.3", "affected_versions_last": "2.3.6" }, { "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "vendor": "adobe", "product": "commerce", "product_type": "a", "vulnerable": true, "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null, "affected_versions_first": "2.4.0", "affected_versions_last": "2.4.2" }, { "criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*", "vendor": "adobe", "product": "commerce", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.3.7", "affected_versions_last": "2.3.7" }, { "criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*", "vendor": "adobe", "product": "commerce", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.3.7", "affected_versions_last": "2.3.7" }, { "criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*", "vendor": "adobe", "product": "commerce", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.4.3", "affected_versions_last": "2.4.3" }, { "criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*", "vendor": "adobe", "product": "commerce", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.4.3", "affected_versions_last": "2.4.3" }, { "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*", "vendor": "adobe", "product": "magento", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2.3.0", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*", "vendor": "adobe", "product": "magento", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": "2.3.3", "version_end_including": "2.3.6", "version_end_excluding": null, "affected_versions_first": "2.3.4", "affected_versions_last": "2.3.6" }, { "criteria": "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*", "vendor": "adobe", "product": "magento", "product_type": "a", "vulnerable": true, "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null, "affected_versions_first": "2.4.0", "affected_versions_last": "2.4.2" } ], "cwe": [ { "id": 20, "owasptop10_2021": "A03 Injection", "name": "Improper Input Validation", "description": "The product receives input or data, but it does\n not validate or incorrectly validates that the input has the\n properties that are required to process the data safely and\n correctly.", "capec_id": [ 3, 7, 8, 9, 10, 13, 14, 22, 23, 24 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Read Files or Directories", "Read Memory" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Fuzzing", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.99199, "percentile": 0.99934, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "Adobe", "product": "Commerce and Magento Open Source", "vulnerability_name": "Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability", "date_added": "2022-02-15", "short_description": "Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.", "required_action": "Apply updates per vendor instructions.", "due_date": "2022-03-01", "known_ransomware_campaign_use": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2022-24086" }, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@adobe.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2021-36020", "source_identifier": "user@adobe.com", "published": "2021-09-01T15:15:09Z", "last_modified": "2026-06-17T03:58:13Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution." }, { "lang": "es", "value": "Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de inyección XML en el campo \"City\". Un atacante no autenticado puede desencadenar un script especialmente diseñado para lograr una ejecución de código remota" } ], "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb21-64.html", "source": "user@adobe.com", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://helpx.adobe.com/security/products/magento/apsb21-64.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@adobe.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "LOW", "availability_impact": "NONE", "base_score": 8.2, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 4.2 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@adobe.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-91" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-91" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*", "match_criteria_id": "72F005E6-8523-49FF-91F7-644BC737DDEF", "version_start_including": "2.3.0", "version_start_excluding": null, "version_end_including": "2.3.7", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*", "match_criteria_id": "260156B9-9CEF-4732-AD94-7D3CCD784F1D", "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*", "match_criteria_id": "C711D725-10E3-4A9C-AAD8-9B1766CB42F0", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*", "match_criteria_id": "052A5E47-66AF-4F60-8949-E2B6CE98AEE9", "version_start_including": "2.3.0", "version_start_excluding": null, "version_end_including": "2.3.7", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*", "match_criteria_id": "ADE9F2A6-575A-48DA-ACE4-B22ABB275B6B", "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*", "match_criteria_id": "8F768F94-34F1-4FB8-8D96-3BBC9D6B8C89", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*", "vendor": "adobe", "product": "adobe_commerce", "product_type": "a", "vulnerable": true, "version_start_including": "2.3.0", "version_start_excluding": null, "version_end_including": "2.3.7", "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*", "vendor": "adobe", "product": "adobe_commerce", "product_type": "a", "vulnerable": true, "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null, "affected_versions_first": "2.4.2", "affected_versions_last": "2.4.2" }, { "criteria": "cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*", "vendor": "adobe", "product": "adobe_commerce", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.4.2", "affected_versions_last": "2.4.2" }, { "criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*", "vendor": "adobe", "product": "magento_open_source", "product_type": "a", "vulnerable": true, "version_start_including": "2.3.0", "version_start_excluding": null, "version_end_including": "2.3.7", "version_end_excluding": null, "affected_versions_first": "2.3.7", "affected_versions_last": "2.3.7" }, { "criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*", "vendor": "adobe", "product": "magento_open_source", "product_type": "a", "vulnerable": true, "version_start_including": "2.4.0", "version_start_excluding": null, "version_end_including": "2.4.2", "version_end_excluding": null, "affected_versions_first": "2.4.0", "affected_versions_last": "2.4.2" }, { "criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*", "vendor": "adobe", "product": "magento_open_source", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.4.2", "affected_versions_last": "2.4.2" } ], "cwe": [ { "id": 91, "owasptop10_2021": "A03 Injection", "name": "XML Injection (aka Blind XPath Injection)", "description": "The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.", "capec_id": [ 83, 250 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands", "Modify Application Data", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.02715, "percentile": 0.85389, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Affected Range Starting After 6.3](/reference/vulnerability/search/examples/enrichment-cpe-version-start-excluding/) - [Affected Range Fixed in 19.1.8](/reference/vulnerability/search/examples/enrichment-cpe-version-end-excluding/) - [Affected Range Starting at 12.5.0](/reference/vulnerability/search/examples/enrichment-cpe-version-start-including/) - [First Affected Release 2023.4](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-first/) - [Affected Products That Are Platforms](/reference/vulnerability/search/examples/enrichment-cpe-vulnerable/) - [Last Affected Release 2026.2](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-last/)