PT-2024-6962 · Adobe · Magento Open Source+1

Published 2024-10-08 · Updated 2024-10-10 · CVE-2024-45118

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier

Description The issue is related to an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have high impact on integrity. Exploitation of this issue does not require user interaction.

Recommendations For Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier, update to a version that includes the security fix. For Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier, update to a version that includes the security fix. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-08211

CVE-2024-45118

GHSA-CG52-68FV-94QQ

Affected Products

Commerce

Magento Open Source

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-45118 · Security Note
• https://osv.dev/vulnerability/GHSA-cg52-68fv-94qq · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb24-73.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45118 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08211 · Security Note
• https://github.com/magento/magento2 · Note
• https://t.me/cvedetector/7593 · Telegram Post
• https://t.me/cvenotify/97845 · Telegram Post
• https://twitter.com/CVEnew/status/1844321338909130921 · Twitter Post
• https://t.me/cvenotify/97733 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1844413289926709686 · Twitter Post