PT-2024-5993 · Adobe · Magento Open Source+1

Published

2024-08-13

·

Updated

2024-10-16

·

CVE-2024-39409

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier
Description The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.
Recommendations For Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier, update to a version that is not affected by this issue. For Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier, update to a version that is not affected by this issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating user requests and ensuring that sensitive actions require explicit user confirmation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-06803
CVE-2024-39409
GHSA-RF4Q-M23C-7Q8R

Affected Products

Commerce
Magento Open Source