Vulnerabilites related to adobe - commerce_webhooks
cve-2024-34109
Vulnerability from cvelistv5
Published
2024-06-13 09:05
Modified
2024-09-17 11:08
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.3-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.2-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.1-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.0-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.3.7-p4-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-14T03:55:30.751120Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T13:45:30.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.898Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "HIGH",
"modifiedScope": "UNCHANGED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "HIGH",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation (CWE-20)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T11:08:17.339Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Adobe Commerce | Improper Input Validation (CWE-20)"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34109",
"datePublished": "2024-06-13T09:05:00.703Z",
"dateReserved": "2024-04-30T19:50:50.902Z",
"dateUpdated": "2024-09-17T11:08:17.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34104
Vulnerability from cvelistv5
Published
2024-06-13 09:04
Modified
2024-09-17 11:08
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.3-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.2-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.1-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.0-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.3.7-p4-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34104",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-14T13:48:20.835460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T13:48:49.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:43:00.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 8.2,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "LOW",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "UNCHANGED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 8.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization (CWE-285)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T11:08:38.931Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Adobe Commerce | Improper Authorization (CWE-285)"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34104",
"datePublished": "2024-06-13T09:04:56.852Z",
"dateReserved": "2024-04-30T19:50:50.901Z",
"dateUpdated": "2024-09-17T11:08:38.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34107
Vulnerability from cvelistv5
Published
2024-06-13 09:04
Modified
2024-09-17 11:08
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.3-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.2-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.1-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.0-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.3.7-p4-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-14T13:30:50.245305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T13:37:44.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:43:00.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "LOW",
"modifiedIntegrityImpact": "NONE",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "UNCHANGED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control (CWE-284)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T11:08:47.953Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Adobe Commerce | Improper Access Control (CWE-284)"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34107",
"datePublished": "2024-06-13T09:04:58.392Z",
"dateReserved": "2024-04-30T19:50:50.902Z",
"dateUpdated": "2024-09-17T11:08:47.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34111
Vulnerability from cvelistv5
Published
2024-06-13 09:04
Modified
2024-08-07 14:51
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "adobe_commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T21:18:03.965196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T21:20:36.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:43:00.129Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "NONE",
"modifiedPrivilegesRequired": "LOW",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "LOW",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF) (CWE-918)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T14:51:52.418Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SSRF in service connector"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34111",
"datePublished": "2024-06-13T09:04:59.166Z",
"dateReserved": "2024-04-30T19:50:50.903Z",
"dateUpdated": "2024-08-07T14:51:52.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34106
Vulnerability from cvelistv5
Published
2024-06-13 09:05
Modified
2024-08-02 02:42
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "adobe_commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T16:21:10.281378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T16:22:19.764Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.989Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "NONE",
"modifiedIntegrityImpact": "LOW",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization (CWE-863)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T09:05:02.253Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insecure Direct Object Reference - An attacker can able to erase the victim quote details"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34106",
"datePublished": "2024-06-13T09:05:02.253Z",
"dateReserved": "2024-04-30T19:50:50.901Z",
"dateUpdated": "2024-08-02T02:42:59.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34103
Vulnerability from cvelistv5
Published
2024-06-13 09:05
Modified
2024-08-02 02:42
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.3-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.2-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.1-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.0-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.3.7-p4-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-14T03:55:29.165247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T13:43:02.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 8.1,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "HIGH",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 8.1,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication (CWE-287)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T09:05:01.465Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Customer account takeover via web API call \u0026 subsequent password reset"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34103",
"datePublished": "2024-06-13T09:05:01.465Z",
"dateReserved": "2024-04-30T19:50:50.901Z",
"dateUpdated": "2024-08-02T02:42:59.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34105
Vulnerability from cvelistv5
Published
2024-06-13 09:04
Modified
2024-08-02 02:42
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T16:04:12.111666Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T16:04:26.254Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.883Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 4.8,
"environmentalSeverity": "MEDIUM",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "NONE",
"modifiedConfidentialityImpact": "LOW",
"modifiedIntegrityImpact": "LOW",
"modifiedPrivilegesRequired": "HIGH",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "HIGH",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "CHANGED",
"temporalScore": 4.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site Scripting (Stored XSS) (CWE-79)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T09:04:57.617Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross Site Scripting in Order Comment"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34105",
"datePublished": "2024-06-13T09:04:57.617Z",
"dateReserved": "2024-04-30T19:50:50.901Z",
"dateUpdated": "2024-08-02T02:42:59.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34110
Vulnerability from cvelistv5
Published
2024-06-13 09:04
Modified
2024-08-02 02:43
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34110",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T03:55:31.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:43:00.355Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "HIGH",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "HIGH",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload of File with Dangerous Type (CWE-434)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T09:04:59.918Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "RCE in the Adobe Commerce Webhook module through a legit webhook definition"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34110",
"datePublished": "2024-06-13T09:04:59.918Z",
"dateReserved": "2024-04-30T19:50:50.902Z",
"dateUpdated": "2024-08-02T02:43:00.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34108
Vulnerability from cvelistv5
Published
2024-06-13 09:04
Modified
2024-08-07 14:47
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.
References
| ▼ | URL | Tags |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb24-40.html | vendor-advisory |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.3-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.2-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.1-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.0-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.3.7-p4-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "magento_open_source",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T03:55:29.523Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.883Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 9.1,
"environmentalSeverity": "CRITICAL",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "HIGH",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "HIGH",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "CHANGED",
"temporalScore": 9.1,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation (CWE-20)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T14:47:37.071Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Large attack surface through legit webhook usage in Adobe Commerce"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34108",
"datePublished": "2024-06-13T09:04:55.355Z",
"dateReserved": "2024-04-30T19:50:50.902Z",
"dateUpdated": "2024-08-07T14:47:37.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-34102
Vulnerability from cvelistv5
Published
2024-06-13 09:04
Modified
2025-02-13 17:52
Severity ?
EPSS score ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Adobe | Adobe Commerce |
Version: 0 ≤ 2.4.4-p8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "commerce",
"vendor": "adobe",
"versions": [
{
"lessThanOrEqual": "2.4.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.6-p5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.5-p7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.3-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.2-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.1-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.0-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.3.7-p4-ext-7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34102",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-07-17",
"reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-18T03:55:18.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:42:59.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Adobe Commerce",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "2.4.4-p8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-06-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "NETWORK",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "NOT_DEFINED",
"modifiedUserInteraction": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) (CWE-611)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-03T16:00:03.226Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"url": "https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "XXE can expose crypt key and other secrets granting full admin access"
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2024-34102",
"datePublished": "2024-06-13T09:04:56.093Z",
"dateReserved": "2024-04-30T19:50:50.900Z",
"dateUpdated": "2025-02-13T17:52:23.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de autorizaci\u00f3n incorrecta que podr\u00eda provocar la omisi\u00f3n de una caracter\u00edstica de seguridad. Un atacante podr\u00eda aprovechar esta vulnerabilidad para obtener acceso no autorizado o realizar acciones con los privilegios de otro usuario. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2024-34106",
"lastModified": "2024-11-21T09:18:06.667",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:11.697",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de autorizaci\u00f3n incorrecta que podr\u00eda provocar la omisi\u00f3n de una funci\u00f3n de seguridad. Un atacante podr\u00eda aprovechar esta vulnerabilidad para eludir las medidas de seguridad y obtener acceso no autorizado, lo que tendr\u00eda un impacto tanto en la confidencialidad como en la integridad. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2024-34104",
"lastModified": "2024-11-21T09:18:06.377",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:11.017",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-29 15:33
Severity ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@adobe.com | https://helpx.adobe.com/security/products/magento/apsb24-40.html | Vendor Advisory | |
| psirt@adobe.com | https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://helpx.adobe.com/security/products/magento/apsb24-40.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102 | Exploit, Technical Description, Third Party Advisory |
Impacted products
{
"cisaActionDue": "2024-08-07",
"cisaExploitAdd": "2024-07-17",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-7:*:*:*:*:*:*",
"matchCriteriaId": "F4F3CDEB-7BEE-44F7-A927-DCA209429D96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-7:*:*:*:*:*:*",
"matchCriteriaId": "FFCF3470-0C38-4F54-9BFF-B5819805AECB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*",
"matchCriteriaId": "8867F510-201C-4199-8554-53DE156CE669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*",
"matchCriteriaId": "8922D646-1A97-47ED-91C6-5A426781C98A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*",
"matchCriteriaId": "3A9A62EE-1649-4815-8EC9-7AEF7949EB2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:*",
"matchCriteriaId": "B5D04853-0C2F-47DD-A939-3A8F6E22CB7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7EC901F8-73E4-4B13-9855-D7B157D37EA3",
"versionEndExcluding": "1.5.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:-:*:*:open_source:*:*:*",
"matchCriteriaId": "0E06FE04-8844-4409-92D9-4972B47C921B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de restricci\u00f3n inadecuada de referencia de entidad externa XML (\"XXE\") que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando un documento XML manipulado que haga referencia a entidades externas. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2024-34102",
"lastModified": "2024-11-29T15:33:14.280",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:10.380",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "psirt@adobe.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-611"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de validaci\u00f3n de entrada incorrecta que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario, pero se requieren privilegios de administrador"
}
],
"id": "CVE-2024-34108",
"lastModified": "2024-11-21T09:18:06.987",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0,
"source": "psirt@adobe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:12.447",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de cross-site scripting (XSS) almacenado de la que podr\u00eda ser abusado por un atacante administrador para inyectar scripts maliciosos en campos de formulario vulnerables. Se puede ejecutar JavaScript malicioso en el navegador de la v\u00edctima cuando navega a la p\u00e1gina que contiene el campo vulnerable."
}
],
"id": "CVE-2024-34105",
"lastModified": "2024-11-21T09:18:06.520",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:11.340",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de Server-Side Request Forgery (SSRF) que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando una solicitud manipulada al servidor, lo que podr\u00eda provocar que el servidor ejecute c\u00f3digo arbitrario. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2024-34111",
"lastModified": "2024-11-21T09:18:07.443",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "psirt@adobe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:13.537",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "psirt@adobe.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de validaci\u00f3n de entrada incorrecta que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario, pero se requieren privilegios de administrador."
}
],
"id": "CVE-2024-34109",
"lastModified": "2024-11-21T09:18:07.147",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:12.820",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de autenticaci\u00f3n incorrecta que podr\u00eda provocar una escalada de privilegios. Un atacante podr\u00eda aprovechar esta vulnerabilidad para obtener acceso no autorizado o privilegios elevados dentro de la aplicaci\u00f3n. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario, pero la complejidad del ataque es alta."
}
],
"id": "CVE-2024-34103",
"lastModified": "2024-11-21T09:18:06.227",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:10.720",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "psirt@adobe.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de control de acceso inadecuado que podr\u00eda provocar la omisi\u00f3n de una funci\u00f3n de seguridad. Un atacante podr\u00eda aprovechar esta vulnerabilidad para eludir las medidas de seguridad y obtener acceso no autorizado. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2024-34107",
"lastModified": "2024-11-21T09:18:06.823",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@adobe.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:12.053",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-06-13 09:15
Modified
2024-11-21 09:18
Severity ?
Summary
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*",
"matchCriteriaId": "3A3535F6-227F-4DD2-881F-9ADAB68373CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*",
"matchCriteriaId": "428B889D-3BAF-46A2-913A-E0022217F804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*",
"matchCriteriaId": "2A0A7F6F-6218-4714-A7C7-79580FBA8FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*",
"matchCriteriaId": "304A7DB2-0174-42A2-A357-944634C2ADFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*",
"matchCriteriaId": "C5954698-9CA1-4463-833C-E7DB447AC80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D845F99F-2958-4118-B27E-6D84602B7FB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "61266FCB-916E-4B72-A5CE-8E9D3D817996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "4B4BB14A-5BBE-4FF3-B956-306D721D99E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8D33D70D-84E7-46D9-A50B-857DF71B43C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "6291AFE6-3F06-4796-B6B8-761D995F1F9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*",
"matchCriteriaId": "33BE2A5D-A4B1-4863-A1D9-29F08CA8CCE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "F1BCDF10-D4D2-4FB5-8A6A-960730C17911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "F747F9C6-BD3F-4DFC-BC91-6361F66E50D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "8249B061-BD24-4A05-A08B-8CE776C23F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "40315EF0-0EAF-465B-BC82-57B74C23ED98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*",
"matchCriteriaId": "62BF6A4C-BC58-40A2-AE21-B4F309562661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "1D0E8BC4-17BD-4F42-A849-2CC439CF82D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E9E12EC1-36A9-42F5-9EE6-88FAA6FD52F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "F2B3EF0E-31B4-4508-AC48-D89CB4460D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "B0B4ABDB-1C22-4B26-BA4D-DA73ED1F50D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*",
"matchCriteriaId": "FC5B997C-8DB4-4FDF-96F6-6DCF23970705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*",
"matchCriteriaId": "E8B1341E-A0C9-42EB-8BAE-E23D88BC3CB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*",
"matchCriteriaId": "14CEAFB8-0812-4F19-8E83-93A61A23594F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*",
"matchCriteriaId": "25A9AC2F-7AAC-41FF-8D93-3A5CBE24BED6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*",
"matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*",
"matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*",
"matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*",
"matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*",
"matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*",
"matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*",
"matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*",
"matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*",
"matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*",
"matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*",
"matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*",
"matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*",
"matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*",
"matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*",
"matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*",
"matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*",
"matchCriteriaId": "75FC038A-FDAE-4A80-B3A2-BE38F53841B6",
"versionEndIncluding": "1.4.0",
"versionStartIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*",
"matchCriteriaId": "AC641EFE-3B9B-4988-A143-FE1F6FD0D689",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "5F7AA4A6-69E3-4BA4-A476-CA37F41D5482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "A3D05570-FA72-4FCF-90E9-EC19731CD9F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "7DF079F1-1886-4974-A0F0-82DEA88F2E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "C4E7AFE2-E02D-4C7D-B9C3-CEF345F1287C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "F39BCCFC-4748-4626-8E35-4BD299CE42A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "EB9003A6-F5CC-463F-AC3A-C76F96A39F45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "10DBD0CA-AFC2-4E12-9239-C2FBE778E6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*",
"matchCriteriaId": "FBB3AA19-BF6C-4C4B-A213-494D35F08D99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*",
"matchCriteriaId": "7A41C717-4B9F-4972-ABA3-2294EEC20F3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "3FA80BBC-2DF2-46E1-84CE-8A899415114E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "510B1840-AE77-4BDD-9C09-26C64CC8FC81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "FA1EDF58-8384-48C4-A584-54D24F6F7973",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "9D2D9715-3A6B-4BE0-B1C5-8D19A683A083",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "1C99B578-5DD6-476D-BB75-4DCAD7F79535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*",
"matchCriteriaId": "7C1B2897-79A5-4A5B-9137-7A4B6B85AA84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*",
"matchCriteriaId": "B9E8299D-FA97-483A-8E1B-BA7B869E467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*",
"matchCriteriaId": "789BD987-9DAD-4EAE-93DE-0E267D54F124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*",
"matchCriteriaId": "A3F113C0-00C5-4BC2-B42B-8AE3756252F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*",
"matchCriteriaId": "02592D65-2D2C-460A-A970-8A18F9B156ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*",
"matchCriteriaId": "457B89CF-C75E-4ED6-8603-9C52BA462A9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*",
"matchCriteriaId": "A572A2DC-2DAB-4ABE-8FC2-5AF2340C826F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*",
"matchCriteriaId": "2A2DD9C6-BAF5-4DF5-9C14-3478923B2019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*",
"matchCriteriaId": "99C620F3-40ED-4D7F-B6A1-205E948FD6F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction."
},
{
"lang": "es",
"value": "Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de carga sin restricciones de archivos con tipo peligroso que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. Un atacante con altos privilegios podr\u00eda aprovechar esta vulnerabilidad cargando un archivo malicioso en el sistema, que luego podr\u00eda ejecutarse. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2024-34110",
"lastModified": "2024-11-21T09:18:07.297",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "psirt@adobe.com",
"type": "Primary"
}
]
},
"published": "2024-06-13T09:15:13.137",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://helpx.adobe.com/security/products/magento/apsb24-40.html"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "psirt@adobe.com",
"type": "Primary"
}
]
}