PT-2025-6370 · Adobe · Commerce

Published

2025-02-11

·

Updated

2025-02-11

·

CVE-2025-24436

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-beta1 through 2.4.7-p3 Adobe Commerce versions 2.4.6-p8 Adobe Commerce versions 2.4.5-p10 Adobe Commerce versions 2.4.4-p11 and earlier
Description The issue is related to an Improper Access Control vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
Recommendations For Adobe Commerce versions 2.4.7-beta1 through 2.4.7-p3, update to a version that fixes the Improper Access Control vulnerability. For Adobe Commerce versions 2.4.6-p8, update to a version that fixes the Improper Access Control vulnerability. For Adobe Commerce versions 2.4.5-p10, update to a version that fixes the Improper Access Control vulnerability. For Adobe Commerce versions 2.4.4-p11 and earlier, update to a version that fixes the Improper Access Control vulnerability. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284CWE-863

Related Identifiers

BDU:2025-05399
CVE-2025-24436
GHSA-GHPR-6QHR-RPP8

Affected Products

Commerce