GitHub Advisoryadvisory · Packagist

GHSA-f7q4-9gwv-6774 Magento Open Source Improper Authentication vulnerability

CRITICAL Published 2024-06-13 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-34103
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2024-08-07

Affected packages

• Packagist magento/community-edition: 2.4.7 (no fix yet) • Packagist magento/community-edition: 2.4.6 (no fix yet) • Packagist magento/community-edition: 2.4.5 (no fix yet) • Packagist magento/community-edition: 2.4.4 (no fix yet) • Packagist magento/community-edition: >= 2.4.6-p1, < 2.4.6-p6 → fixed in 2.4.6-p6 • Packagist magento/community-edition: >= 2.4.5-p1, < 2.4.5-p8 → fixed in 2.4.5-p8 • Packagist magento/community-edition: < 2.4.4-p9 → fixed in 2.4.4-p9

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Related

Alias · CVE (1)

  • CVE-2024-34103 Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References