PT-2024-6955 · Adobe · Commerce

Published 2024-10-08 · Updated 2024-10-16 · CVE-2024-45148

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier

Description The issue is related to an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction. The vulnerability is associated with deficiencies in the authentication procedure, which can allow a remote attacker to bypass security restrictions.

Recommendations For Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier, update to a version that includes the fix for the Improper Authentication vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-08204

BIT-MAGENTO-2024-45148

CVE-2024-45148

Affected Products

Commerce

References · 10

• https://helpx.adobe.com/security/products/magento/apsb24-73.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45148 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45148 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2024-45148 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08204 · Security Note
• https://twitter.com/CveFindCom/status/1844317208060596325 · Twitter Post
• https://twitter.com/CVEnew/status/1844321335864148281 · Twitter Post
• https://t.me/cvenotify/97918 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1844395369087524898 · Twitter Post
• https://t.me/cvedetector/7582 · Telegram Post