GitHub Advisory DatabaseGHSA-9WJF-94H3-R4RHMagento Improper Access Control vulnerability
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.7 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
45.3%
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user’s minor feature. Exploitation of this issue does not require user interaction.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| magento/community-edition | lt | 2.4.3-p3 | |
| magento/community-edition | lt | 2.4.5 | |
| magento/community-edition | lt | 2.3.7-p4 |
References
github.com/advisories/GHSA-9wjf-94h3-r4rh
github.com/magento/magento2/commit/246d524b7586af2245092008e0d92b8d6fdd8523
github.com/magento/magento2/commit/5548bc64b5bc904346c0af9193a7fbb5274b4efa
github.com/magento/magento2/commit/5f07eba878296a37bd5c3a2baecad48948547594
helpx.adobe.com/security/products/magento/apsb22-38.html
nvd.nist.gov/vuln/detail/CVE-2022-34259
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.7 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
45.3%