PT-2024-6965 · Adobe · Commerce

Published 2024-10-08 · Updated 2024-12-12 · CVE-2024-45120

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-p2 through 2.4.4-p10 and earlier

Description The issue is related to a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use of a resource, having a low impact on integrity. Exploitation of this issue requires user interaction. The vulnerability is associated with synchronization errors when using a shared resource.

Recommendations For Adobe Commerce versions 2.4.7-p2 through 2.4.4-p10 and earlier, update to a version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing additional security measures to minimize the risk of exploitation, such as restricting access to shared resources and monitoring user interactions.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2024-08214

CVE-2024-45120

GHSA-47JP-46C9-25VF

Affected Products

Commerce

References · 9

• https://osv.dev/vulnerability/GHSA-47jp-46c9-25vf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45120 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45120 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb24-73.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08214 · Security Note
• https://github.com/magento/magento2 · Note
• https://twitter.com/VulmonFeeds/status/1844415849630695845 · Twitter Post
• https://twitter.com/CVEnew/status/1844321331980165421 · Twitter Post
• https://t.me/cvenotify/104102 · Telegram Post