Lucene search

K
nvd[email protected]NVD:CVE-2023-29294
HistoryJun 15, 2023 - 7:15 p.m.

CVE-2023-29294

2023-06-1519:15:11
CWE-840
web.nvd.nist.gov
4
adobe commerce
2.4.6
business logic errors
security bypass
low-privileged attacker
exploitation

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.3%

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

Affected configurations

NVD
Node
adobecommerceMatch2.3.7-
OR
adobecommerceMatch2.3.7p1
OR
adobecommerceMatch2.3.7p2
OR
adobecommerceMatch2.3.7p3
OR
adobecommerceMatch2.3.7p4
OR
adobecommerceMatch2.3.7p4-ext1
OR
adobecommerceMatch2.3.7p4-ext2
OR
adobecommerceMatch2.4.0-
OR
adobecommerceMatch2.4.0ext-1
OR
adobecommerceMatch2.4.0ext-2
OR
adobecommerceMatch2.4.1-
OR
adobecommerceMatch2.4.1ext-1
OR
adobecommerceMatch2.4.1ext-2
OR
adobecommerceMatch2.4.2-
OR
adobecommerceMatch2.4.2ext-1
OR
adobecommerceMatch2.4.2ext-2
OR
adobecommerceMatch2.4.3-
OR
adobecommerceMatch2.4.3ext-1
OR
adobecommerceMatch2.4.3ext-2
OR
adobecommerceMatch2.4.4-
OR
adobecommerceMatch2.4.4p1
OR
adobecommerceMatch2.4.4p2
OR
adobecommerceMatch2.4.4p3
OR
adobecommerceMatch2.4.5-
OR
adobecommerceMatch2.4.5p1
OR
adobecommerceMatch2.4.5p2
OR
adobecommerceMatch2.4.6-
OR
adobemagentoMatch2.4.4-open_source
OR
adobemagentoMatch2.4.4p1open_source
OR
adobemagentoMatch2.4.4p2open_source
OR
adobemagentoMatch2.4.4p3open_source
OR
adobemagentoMatch2.4.5-open_source
OR
adobemagentoMatch2.4.5p1open_source
OR
adobemagentoMatch2.4.5p2open_source
OR
adobemagentoMatch2.4.6-open_source

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.3%

Related for NVD:CVE-2023-29294