CVE-2024-45132

Published: Oct 10, 2024Modified: Oct 14, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect confidentiality. Exploitation of this issue does not require user interaction.

Affected (116)

Products: Adobe: Commerce, Commerce B2b, Magento

3 products

Configuration A

116 vulnerable

Vulnerable Software	Affected Versions
Adobe Commerce	All versions
Adobe Commerce	Version 2.3.7
Adobe Commerce	Version 2.3.7 p1
Adobe Commerce	Version 2.3.7 p2
Adobe Commerce	Version 2.3.7 p3
Adobe Commerce	Version 2.3.7 p4-ext1
Adobe Commerce	Version 2.3.7 p4-ext2
Adobe Commerce	Version 2.3.7 p4-ext3
Adobe Commerce	Version 2.3.7 p4-ext4
Adobe Commerce	Version 2.3.7 p4
Adobe Commerce	Version 2.4.0
Adobe Commerce	Version 2.4.0
Adobe Commerce	Version 2.4.0 ext-1
Adobe Commerce	Version 2.4.0 ext-2
Adobe Commerce	Version 2.4.0 ext-3
Adobe Commerce	Version 2.4.0 ext-4
Adobe Commerce	Version 2.4.1
Adobe Commerce	Version 2.4.1
Adobe Commerce	Version 2.4.1 ext-1
Adobe Commerce	Version 2.4.1 ext-2
Adobe Commerce	Version 2.4.1 ext-3
Adobe Commerce	Version 2.4.1 ext-4
Adobe Commerce	Version 2.4.2
Adobe Commerce	Version 2.4.2
Adobe Commerce	Version 2.4.2 ext-1
Adobe Commerce	Version 2.4.2 ext-2
Adobe Commerce	Version 2.4.2 ext-3
Adobe Commerce	Version 2.4.2 ext-4
Adobe Commerce	Version 2.4.2 p1
Adobe Commerce	Version 2.4.2 p2
Adobe Commerce	Version 2.4.3
Adobe Commerce	Version 2.4.3
Adobe Commerce	Version 2.4.3 ext-1
Adobe Commerce	Version 2.4.3 ext-2
Adobe Commerce	Version 2.4.3 ext-3
Adobe Commerce	Version 2.4.3 ext-4
Adobe Commerce	Version 2.4.3 p1
Adobe Commerce	Version 2.4.3 p2
Adobe Commerce	Version 2.4.4
Adobe Commerce	Version 2.4.4 p10
Adobe Commerce	Version 2.4.4 p1
Adobe Commerce	Version 2.4.4 p2
Adobe Commerce	Version 2.4.4 p3
Adobe Commerce	Version 2.4.4 p4
Adobe Commerce	Version 2.4.4 p5
Adobe Commerce	Version 2.4.4 p6
Adobe Commerce	Version 2.4.4 p7
Adobe Commerce	Version 2.4.4 p8
Adobe Commerce	Version 2.4.4 p9
Adobe Commerce	Version 2.4.5
Adobe Commerce	Version 2.4.5 p1
Adobe Commerce	Version 2.4.5 p2
Adobe Commerce	Version 2.4.5 p3
Adobe Commerce	Version 2.4.5 p4
Adobe Commerce	Version 2.4.5 p5
Adobe Commerce	Version 2.4.5 p6
Adobe Commerce	Version 2.4.5 p7
Adobe Commerce	Version 2.4.5 p8
Adobe Commerce	Version 2.4.5 p9
Adobe Commerce	Version 2.4.6
Adobe Commerce	Version 2.4.6 p1
Adobe Commerce	Version 2.4.6 p2
Adobe Commerce	Version 2.4.6 p3
Adobe Commerce	Version 2.4.6 p4
Adobe Commerce	Version 2.4.6 p5
Adobe Commerce	Version 2.4.6 p6
Adobe Commerce	Version 2.4.6 p7
Adobe Commerce	Version 2.4.7
Adobe Commerce	Version 2.4.7 b1
Adobe Commerce	Version 2.4.7 b2
Adobe Commerce	Version 2.4.7 p1
Adobe Commerce	Version 2.4.7 p2
Adobe Commerce B2b	Version 1.3.3
Adobe Commerce B2b	Version 1.3.3 p10
Adobe Commerce B2b	Version 1.3.4
Adobe Commerce B2b	Version 1.3.4 p9
Adobe Commerce B2b	Version 1.3.5
Adobe Commerce B2b	Version 1.3.5 p7
Adobe Commerce B2b	Version 1.4.2
Adobe Commerce B2b	Version 1.4.2 p1
Adobe Commerce B2b	Version 1.4.2 p2
Adobe Magento	All versions
Adobe Magento	Version 2.4.3
Adobe Magento	Version 2.4.4
Adobe Magento	Version 2.4.4 p10
Adobe Magento	Version 2.4.4 p1
Adobe Magento	Version 2.4.4 p2
Adobe Magento	Version 2.4.4 p3
Adobe Magento	Version 2.4.4 p4
Adobe Magento	Version 2.4.4 p5
Adobe Magento	Version 2.4.4 p6
Adobe Magento	Version 2.4.4 p7
Adobe Magento	Version 2.4.4 p8
Adobe Magento	Version 2.4.4 p9
Adobe Magento	Version 2.4.5
Adobe Magento	Version 2.4.5 p1
Adobe Magento	Version 2.4.5 p2
Adobe Magento	Version 2.4.5 p3
Adobe Magento	Version 2.4.5 p4
Adobe Magento	Version 2.4.5 p5
Adobe Magento	Version 2.4.5 p6
Adobe Magento	Version 2.4.5 p7
Adobe Magento	Version 2.4.5 p8
Adobe Magento	Version 2.4.5 p9
Adobe Magento	Version 2.4.6
Adobe Magento	Version 2.4.6 p1
Adobe Magento	Version 2.4.6 p2
Adobe Magento	Version 2.4.6 p3
Adobe Magento	Version 2.4.6 p4
Adobe Magento	Version 2.4.6 p5
Adobe Magento	Version 2.4.6 p6
Adobe Magento	Version 2.4.6 p7
Adobe Magento	Version 2.4.7
Adobe Magento	Version 2.4.7 b1
Adobe Magento	Version 2.4.7 p1
Adobe Magento	Version 2.4.7 p2

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://helpx.adobe.com/security/products/magento/apsb24-73.html

Source: psirt@adobe.com

Vendor Advisory

Timeline

No history available yet.