Back

CVE-2024-34106

June 13, 2024, 6:35 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Adobe Commerce

  • 2.4.7
  • 2.4.6-p5
  • 2.4.5-p7
  • 2.4.4-p8 and earlier

Source

psirt@adobe.com

Tags

psirt@adobe.com
CWE-863
2024-06-13
CVE-2024-34106

CVE-2024-34106 details

Published : June 13, 2024, 9:15 a.m.
Last Modified : June 13, 2024, 6:35 p.m.

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

CVSS Score

1 2 3 4 5.3 6 7 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Base Score

5.3

Exploitability Score

Impact Score

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

URL Source
https://helpx.adobe.com/security/products/magento/apsb24-40.html psirt@adobe.com
This website uses the NVD API, but is not approved or certified by it.