GitHub Advisoryadvisory · Packagist

GHSA-297f-r9w7-w492 Magento Improper input validation vulnerability

HIGH Published 2022-10-20 Modified 2024-04-23 Official page ↗
Aliases
CVE-2022-42344
Ecosystem
Packagist
Packages
magento/community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-639, CWE-863
Reviewed
2024-04-23

Affected packages

• Packagist magento/community-edition: < 2.3.7-p4 → fixed in 2.3.7-p4 • Packagist magento/community-edition: >= 2.4.0, < 2.4.3-p3 → fixed in 2.4.3-p3 • Packagist magento/community-edition: >= 2.4.4, < 2.4.5 → fixed in 2.4.5

Description

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.

Related

Alias · CVE (1)

  • CVE-2022-42344 Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization… vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-863 Incorrect Authorization weakness

References