PT-2024-4142 · Adobe · Commerce

CVE-2024-34107 · Published 2024-06-11 · Updated 2024-08-12

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier

Description The issue is related to insufficient access control in Adobe Commerce, allowing a remote attacker to bypass existing security restrictions. This could result in a security feature bypass, enabling the attacker to gain unauthorized access without requiring user interaction.

Recommendations For Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, update the system to a newer version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-04621

BIT-MAGENTO-2024-34107

CVE-2024-34107

GHSA-R7CM-G469-WM4G

Affected Products

Commerce

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34107.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-34107 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7cm-g469-wm4g · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb24-40.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2024-34107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34107 · Security Note
• https://bdu.fstec.ru/vul/2024-04621 · Security Note
• https://github.com/magento/magento2 · Note
• https://github.com/magento/magento2/commit/c5c538810b87449886f4669cb8abbe8e5593c83c · Note
• https://github.com/magento/magento2/commit/a3c6d6e5e95e63031e4df26cfcf76feace7549c2 · Note
• https://github.com/magento/magento2/commit/d10435b11ada4e502dca7539f8fd31d059d3c482 · Note
• https://github.com/magento/magento2/commit/30877fce83b793f71421c47347885cf076e81799 · Note
• https://twitter.com/Hossted_OSS/status/1823010495751659525 · Twitter Post
• https://t.me/cvenotify/83139 · Telegram Post