PT-2022-6404 · Adobe · Commerce

Published 2022-08-09 · Updated 2024-03-06 · CVE-2022-42344

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.3-p2 and earlier Adobe Commerce versions 2.3.7-p3 and earlier Adobe Commerce versions 2.4.4 and earlier

Description The issue is related to insufficient input validation, allowing a remote attacker to potentially elevate their privileges. An authenticated attacker can exploit this to achieve information exposure and privilege escalation. The vulnerability can be triggered through an insecure direct object reference in the V1/customers/me endpoint.

Recommendations For Adobe Commerce versions 2.4.3-p2 and earlier, update to a version that includes the fix for this issue. For Adobe Commerce versions 2.3.7-p3 and earlier, update to a version that includes the fix for this issue. For Adobe Commerce versions 2.4.4 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the V1/customers/me endpoint to minimize the risk of exploitation.

Fix

Incorrect Authorization

IDOR

RCE

Weakness Enumeration

CWE-863

CWE-639

CWE-20

Related Identifiers

BDU:2023-01175

BIT-MAGENTO-2022-42344

CVE-2022-42344

GHSA-297F-R9W7-W492

Affected Products

Commerce

References · 10

• https://osv.dev/vulnerability/GHSA-297f-r9w7-w492 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb22-38.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2022-42344 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42344 · Security Note
• https://bdu.fstec.ru/vul/2023-01175 · Security Note
• https://github.com/magento/magento2 · Note
• https://t.me/cvenotify/62147 · Telegram Post
• https://t.me/cibsecurity/51893 · Telegram Post
• https://vuldb.com/?id.211914 · Note