Lucene search

GoogleOSV:BIT-MAGENTO-2024-34107

HistoryJun 17, 2024 - 7:25 a.m.

BIT-magento-2024-34107

2024-06-1707:25:09

Google

osv.dev

adobe commerce

improper access control

security feature bypass

unauthorized access

vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

CPENameOperatorVersion
magentolt2.4.4-p9
magentolt2.4.3-ext-8
magentoge2.4.6-alpha0
magentoge2.4.7-alpha0
magentoge2.4.2-alpha0
magentolt2.3.4-p4-ext-8
magentoge2.4.4-alpha0
magentolt2.4.0-ext-8
magentolt2.4.1-ext-8
magentoge2.4.0-alpha0

Name	Operator	Version
magento	lt	2.4.4-p9
magento	lt	2.4.3-ext-8
magento	ge	2.4.6-alpha0
magento	ge	2.4.7-alpha0
magento	ge	2.4.2-alpha0
magento	lt	2.3.4-p4-ext-8
magento	ge	2.4.4-alpha0
magento	lt	2.4.0-ext-8
magento	lt	2.4.1-ext-8
magento	ge	2.4.0-alpha0

Rows per page:

1-10 of 171

References

helpx.adobe.com/security/products/magento/apsb24-40.html

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for OSV:BIT-MAGENTO-2024-34107