PT-2024-4142 · Adobe · Commerce

Published 2024-06-11 · Updated 2024-08-12 · CVE-2024-34107

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier

Description The issue is related to insufficient access control in Adobe Commerce, allowing a remote attacker to bypass existing security restrictions. This could result in a security feature bypass, enabling the attacker to gain unauthorized access without requiring user interaction.

Recommendations For Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, update the system to a newer version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-04621

BIT-MAGENTO-2024-34107

CVE-2024-34107

GHSA-R7CM-G469-WM4G

Affected Products

Commerce

References · 13

• https://osv.dev/vulnerability/CVE-2024-34107 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2024-34107 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7cm-g469-wm4g · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb24-40.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34107 · Security Note
• https://bdu.fstec.ru/vul/2024-04621 · Security Note
• https://github.com/magento/magento2 · Note
• https://github.com/magento/magento2/commit/a3c6d6e5e95e63031e4df26cfcf76feace7549c2 · Note
• https://github.com/magento/magento2/commit/d10435b11ada4e502dca7539f8fd31d059d3c482 · Note
• https://github.com/magento/magento2/commit/c5c538810b87449886f4669cb8abbe8e5593c83c · Note
• https://github.com/magento/magento2/commit/30877fce83b793f71421c47347885cf076e81799 · Note
• https://t.me/cvenotify/83139 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1823010495751659525 · Twitter Post