PT-2025-6361 · Adobe · Commerce

Published 2025-02-11 · Updated 2025-02-11 · CVE-2025-24425

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier

Description The issue is a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations, causing limited data modification. Exploitation of this issue does not require user interaction.

Recommendations For Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier, update to a version that includes a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-840

Related Identifiers

BDU:2025-02418

CVE-2025-24425

GHSA-6FF8-JRFG-43HH

Affected Products

Commerce

References · 9

• https://osv.dev/vulnerability/GHSA-6ff8-jrfg-43hh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24425 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb25-08.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02418 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24425 · Security Note
• https://github.com/magento/magento2 · Note
• https://reddit.com/r/k12cybersecurity/comments/1inbdtl/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://twitter.com/CVEnew/status/1889371460474417369 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1889445281864765516 · Twitter Post