by Kastro
Paper/Archive/CVE-2024-34107

CVE-2024-34107

Adobe Adobe Commerce — Adobe Commerce | Improper Access Control (CWE-284)

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.5.665 × 2013.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
Adobe Commerce≤ 2.4.4-p8–CNA
commerce≤ 2.4.7–CISA-ADP
commerce≤ 2.4.6-p5–CISA-ADP
commerce≤ 2.4.5-p7–CISA-ADP
commerce≤ 2.4.4-p8–CISA-ADP
commerce≤ 2.4.3-ext-7–CISA-ADP
commerce≤ 2.4.2-ext-7–CISA-ADP
commerce≤ 2.4.1-ext-7–CISA-ADP
commerce≤ 2.4.0-ext-7–CISA-ADP
commerce≤ 2.3.7-p4-ext-7–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
adobe (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/magento/apsb24-40.html