GitHub Advisoryadvisory · Packagist

GHSA-r7mm-grf3-5fjv Magento Improper Authorization vulnerability

HIGH Published 2022-08-17 Modified 2024-01-11 Official page ↗
Aliases
CVE-2022-34256
Ecosystem
Packagist
Packages
magento/community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-285, CWE-863
Reviewed
2024-01-11

Affected packages

• Packagist magento/community-edition: >= 2.3.0, < 2.3.7-p4 → fixed in 2.3.7-p4 • Packagist magento/community-edition: >= 2.4.4, < 2.4.5 → fixed in 2.4.5 • Packagist magento/community-edition: >= 2.4.0, < 2.4.3-p3 → fixed in 2.4.3-p3

Description

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.

Related

Alias · CVE (1)

  • CVE-2022-34256 Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization… vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References