The vulnerability arose from insufficient domain validation, allowing unauthorized URLs to be processed. The revised validation now strictly limits requests to approved domains, significantly reducing the risk of SSRF attacks.
This vulnerability affects the following application versions:
- Magento 2.4.4-p4
- Magento 2.4.4-p5
- Magento 2.4.4-p6
- Magento 2.4.4-p7
- Magento 2.4.4-p8
- Magento 2.4.4-p9
- Magento 2.4.4-p10
- Magento 2.4.5-p3
- Magento 2.4.5-p4
- Magento 2.4.5-p5
- Magento 2.4.5-p6
- Magento 2.4.5-p7
- Magento 2.4.5-p8
- Magento 2.4.5-p9
- Magento 2.4.6-p1
- Magento 2.4.6-p2
- Magento 2.4.6-p3
- Magento 2.4.6-p4
- Magento 2.4.6-p5
- Magento 2.4.6-p6
- Magento 2.4.6-p7
- Magento 2.4.7
- Magento 2.4.7-beta1
- Magento 2.4.7-beta2
- Magento 2.4.7-beta3
- Magento 2.4.7-p1
- Magento 2.4.7-p2