GitHub Advisoryadvisory · Packagist

GHSA-wwj3-573j-rvvm Magento Open Source Improper Authorization vulnerability

HIGH Published 2024-06-13 Modified 2024-08-07 Official page ↗
Aliases
CVE-2024-34104
Ecosystem
Packagist
Packages
magento/community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-285
Reviewed
2024-08-07

Affected packages

• Packagist magento/community-edition: 2.4.7 (no fix yet) • Packagist magento/community-edition: 2.4.6 (no fix yet) • Packagist magento/community-edition: 2.4.5 (no fix yet) • Packagist magento/community-edition: 2.4.4 (no fix yet) • Packagist magento/community-edition: >= 2.4.6-p1, < 2.4.6-p6 → fixed in 2.4.6-p6 • Packagist magento/community-edition: >= 2.4.5-p1, < 2.4.5-p8 → fixed in 2.4.5-p8 • Packagist magento/community-edition: < 2.4.4-p9 → fixed in 2.4.4-p9

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

Related

Alias · CVE (1)

  • CVE-2024-34104 Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References