CVE-2023-23617

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
OpenMage	magento-lts	< 19.4.22; >= 20.0.0, < 20.0.19

References

https://github.com/OpenMage/magento-lts/commit/494027785bdb7db53e60c11ef03c144b61cd3172Patch, Third Party Advisory
https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22Release Notes, Third Party Advisory
https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19Release Notes, Third Party Advisory
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3p73-mm7v-4f6mThird Party Advisory
https://github.com/OpenMage/magento-lts/commit/494027785bdb7db53e60c11ef03c144b61cd3172Patch, Third Party Advisory
https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22Release Notes, Third Party Advisory
https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19Release Notes, Third Party Advisory
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3p73-mm7v-4f6mThird Party Advisory

Timeline

Published: Jan 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-236187.8Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windo CVE-2023-236198.8Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.CVE-2023-23626.1The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Cal CVE-2023-236205.3Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-pass CVE-2023-236217.5Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `te CVE-2023-236224.3Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `te CVE-2023-236239.8Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy t CVE-2023-236245.3Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `te CVE-2023-236257.5go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can CVE-2023-236267.5go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted CVE-2023-236276.1Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. Whe CVE-2023-236284.1Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Ac