PT-2024-8727 · Adobe · Commerce

Published 2024-11-12 · Updated 2024-11-18 · CVE-2024-49521

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 3.2.5 and earlier

Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction. The vulnerability is associated with insufficient server-side request validation.

Recommendations For Adobe Commerce versions 3.2.5 and earlier, update to a version that includes the fix for this SSRF vulnerability. As a temporary workaround, consider restricting access to internal systems to minimize the risk of exploitation. Avoid using the vulnerable server to send requests to internal systems until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-10331

CVE-2024-49521

Affected Products

Commerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-49521 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49521 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb24-90.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10331 · Security Note
• https://t.me/cvenotify/102034 · Telegram Post
• https://twitter.com/CVEnew/status/1856380506889437226 · Twitter Post
• https://t.me/cvedetector/10669 · Telegram Post