Lucene search

AdobeCVE-2024-39418

HistoryAug 14, 2024 - 12:15 p.m.

CVE-2024-39418

2024-08-1412:15:29

CWE-285

adobe

web.nvd.nist.gov

adobe commerce

improper authorization

security feature bypass

low-privileged attacker

exploitation

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

18.3%

JSON

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

adobecommerceRange≤2.4.3

adobecommerceMatch2.4.4-

adobecommerceMatch2.4.4p1

adobecommerceMatch2.4.4p2

adobecommerceMatch2.4.4p3

adobecommerceMatch2.4.4p4

adobecommerceMatch2.4.4p5

adobecommerceMatch2.4.4p6

adobecommerceMatch2.4.4p7

adobecommerceMatch2.4.4p8

adobecommerceMatch2.4.4p9

adobecommerceMatch2.4.5-

adobecommerceMatch2.4.5p1

adobecommerceMatch2.4.5p2

adobecommerceMatch2.4.5p3

adobecommerceMatch2.4.5p4

adobecommerceMatch2.4.5p5

adobecommerceMatch2.4.5p6

adobecommerceMatch2.4.5p7

adobecommerceMatch2.4.5p8

adobecommerceMatch2.4.6-

adobecommerceMatch2.4.6p1

adobecommerceMatch2.4.6p2

adobecommerceMatch2.4.6p3

adobecommerceMatch2.4.6p4

adobecommerceMatch2.4.6p5

adobecommerceMatch2.4.6p6

adobecommerceMatch2.4.7-

adobecommerceMatch2.4.7b1

adobecommerceMatch2.4.7b2

adobecommerceMatch2.4.7p1

Node

adobemagentoRange≤2.4.3open_source

adobemagentoMatch2.4.4-open_source

adobemagentoMatch2.4.4p1open_source

adobemagentoMatch2.4.4p2open_source

adobemagentoMatch2.4.4p3open_source

adobemagentoMatch2.4.4p4open_source

adobemagentoMatch2.4.4p5open_source

adobemagentoMatch2.4.4p6open_source

adobemagentoMatch2.4.4p7open_source

adobemagentoMatch2.4.4p8open_source

adobemagentoMatch2.4.4p9open_source

adobemagentoMatch2.4.5-open_source

adobemagentoMatch2.4.5p1open_source

adobemagentoMatch2.4.5p2open_source

adobemagentoMatch2.4.5p3open_source

adobemagentoMatch2.4.5p4open_source

adobemagentoMatch2.4.5p5open_source

adobemagentoMatch2.4.5p6open_source

adobemagentoMatch2.4.5p7open_source

adobemagentoMatch2.4.5p8open_source

adobemagentoMatch2.4.6-open_source

adobemagentoMatch2.4.6p1open_source

adobemagentoMatch2.4.6p2open_source

adobemagentoMatch2.4.6p3open_source

adobemagentoMatch2.4.6p4open_source

adobemagentoMatch2.4.6p5open_source

adobemagentoMatch2.4.6p6open_source

adobemagentoMatch2.4.7-open_source

adobemagentoMatch2.4.7b1open_source

adobemagentoMatch2.4.7b2open_source

adobemagentoMatch2.4.7p1open_source

VendorProductVersionCPE
adobecommerce*cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*
adobecommerce2.4.4cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*

Vendor	Product	Version	CPE
adobe	commerce	*	cpe:2.3:a:adobe:commerce::::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:-::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p1::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p2::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p3::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p4::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p5::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p6::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p7::::::
adobe	commerce	2.4.4	cpe:2.3:a:adobe:commerce:2.4.4:p8::::::

Rows per page:

1-10 of 621

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Adobe Commerce",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2.4.4-p9",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

helpx.adobe.com/security/products/magento/apsb24-61.html

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

18.3%

JSON

Related for CVE-2024-39418