Lucene search
HistoryJun 13, 2024 - 9:15 a.m.
CVE-2024-34107
adobe commerce
improper access control
security feature bypass
unauthorized access
exploitation
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
41.2%
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.
Affected configurations
Node
adobecommerceMatch2.3.7-
ORadobecommerceMatch2.3.7p1
ORadobecommerceMatch2.3.7p2
ORadobecommerceMatch2.3.7p3
ORadobecommerceMatch2.3.7p4
ORadobecommerceMatch2.3.7p4-ext1
ORadobecommerceMatch2.3.7p4-ext2
ORadobecommerceMatch2.3.7p4-ext3
ORadobecommerceMatch2.3.7p4-ext4
ORadobecommerceMatch2.4.0-
ORadobecommerceMatch2.4.0ext-1
ORadobecommerceMatch2.4.0ext-2
ORadobecommerceMatch2.4.0ext-3
ORadobecommerceMatch2.4.0ext-4
ORadobecommerceMatch2.4.1-
ORadobecommerceMatch2.4.1ext-1
ORadobecommerceMatch2.4.1ext-2
ORadobecommerceMatch2.4.1ext-3
ORadobecommerceMatch2.4.1ext-4
ORadobecommerceMatch2.4.2-
ORadobecommerceMatch2.4.2ext-1
ORadobecommerceMatch2.4.2ext-2
ORadobecommerceMatch2.4.2ext-3
ORadobecommerceMatch2.4.2ext-4
ORadobecommerceMatch2.4.3-
ORadobecommerceMatch2.4.3ext-1
ORadobecommerceMatch2.4.3ext-2
ORadobecommerceMatch2.4.3ext-3
ORadobecommerceMatch2.4.3ext-4
ORadobecommerceMatch2.4.4-
ORadobecommerceMatch2.4.4p1
ORadobecommerceMatch2.4.4p2
ORadobecommerceMatch2.4.4p3
ORadobecommerceMatch2.4.4p4
ORadobecommerceMatch2.4.4p5
ORadobecommerceMatch2.4.4p6
ORadobecommerceMatch2.4.5-
ORadobecommerceMatch2.4.5p1
ORadobecommerceMatch2.4.5p2
ORadobecommerceMatch2.4.5p3
ORadobecommerceMatch2.4.5p4
ORadobecommerceMatch2.4.5p5
ORadobecommerceMatch2.4.6-
ORadobecommerceMatch2.4.6p1
ORadobecommerceMatch2.4.6p2
ORadobecommerceMatch2.4.6p3
ORadobecommerce_webhooksRange1.2.0–1.4.0
ORadobemagentoMatch2.4.4-open_source
ORadobemagentoMatch2.4.4p1open_source
ORadobemagentoMatch2.4.4p2open_source
ORadobemagentoMatch2.4.4p3open_source
ORadobemagentoMatch2.4.4p4open_source
ORadobemagentoMatch2.4.4p5open_source
ORadobemagentoMatch2.4.4p6open_source
ORadobemagentoMatch2.4.4p7open_source
ORadobemagentoMatch2.4.4p8open_source
ORadobemagentoMatch2.4.5-open_source
ORadobemagentoMatch2.4.5p1open_source
ORadobemagentoMatch2.4.5p2open_source
ORadobemagentoMatch2.4.5p3open_source
ORadobemagentoMatch2.4.5p4open_source
ORadobemagentoMatch2.4.5p5open_source
ORadobemagentoMatch2.4.5p6open_source
ORadobemagentoMatch2.4.5p7open_source
ORadobemagentoMatch2.4.6-open_source
ORadobemagentoMatch2.4.6p1open_source
ORadobemagentoMatch2.4.6p2open_source
ORadobemagentoMatch2.4.6p3open_source
ORadobemagentoMatch2.4.6p4open_source
ORadobemagentoMatch2.4.6p5open_source
ORadobemagentoMatch2.4.7b1open_source
| Vendor | Product | Version | CPE |
|---|---|---|---|
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:* |
| adobe | commerce | 2.4.0 | cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:* |
Related
osv
osv
Magento Open Source Improper Access Control vulnerability
2024-06-13 09:31:00
CVE-2024-34107
2024-06-13 09:15:12
BIT-magento-2024-34107
2024-06-17 07:25:09
cve
cve
CVE-2024-34107
2024-06-13 09:15:12
vulnrichment
vulnrichment
CVE-2024-34107 Adobe Commerce | Improper Access Control (CWE-284)
2024-06-13 09:04:58
cvelist
cvelist
CVE-2024-34107 Adobe Commerce | Improper Access Control (CWE-284)
2024-06-13 09:04:58
github
github
Magento Open Source Improper Access Control vulnerability
2024-06-13 09:31:00
adobe
adobe
APSB24-40 : Security update available for Adobe Commerce
2024-06-11 00:00:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
41.2%
Related for NVD:CVE-2024-34107