CVE-2022-34255 Adobe Commerce Improper Access Control Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover fo...

CVE-2022-34255 Adobe Commerce Improper Access Control Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover fo...

CVE-2022-34255

Adobe Commerce and Magento Open Source are affected by CVE-2022-34255 (Improper Access Control) allowing privilege escalation and potential account takeover with no user interaction. Affected versions include Adobe Commerce 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. Root c...

CVE-2022-34255 Adobe Commerce Improper Access Control Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover fo...

CVE-2022-34254 Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A lo...

CVE-2022-34254

Adobe Commerce (Magento) versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier are affected by a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory) that could be abused by a low-privilege attacker to read local files and perform Stored ...

CVE-2022-34254 Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A lo...

CVE-2022-34254 Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A lo...

CVE-2022-34256 Adobe Commerce Improper Authorization Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does no...

CVE-2022-34256 Adobe Commerce Improper Authorization Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does no...

CVE-2022-34256

Adobe Commerce (Magento) vulnerable in versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier due to an Improper Authorization issue that could lead to privilege escalation and access to other users’ data. Exploitation does not require user interaction. The issue is documented...

CVE-2022-34256 Adobe Commerce Improper Authorization Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does no...

CVE-2022-34258 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2022-34258 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2022-34258 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2022-34258

Adobe Commerce and Magento Open Source are affected by a stored XSS vulnerability in versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. The issue can be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields, with malicious Jav...

CVE-2022-34259: Improper Access Control

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature...

CVE-2022-34253: XML Injection (aka Blind XPath Injection)

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does...

CVE-2022-34254: Improper Limitation of a Pathname to a Restricted Directory

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A lo...

CVE-2022-34257: Improper Neutralization of Input During Web Page Generation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...