CVE-2024-45149

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2024-45119

Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2024-45120

Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use of a resource, having a low impact on integrity. Exploitation of this issue requires user interaction.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2024-34111

SSRF in service connector

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34110

RCE in the Adobe Commerce Webhook module through a legit webhook definition

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34109

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34108

Large attack surface through legit webhook usage in Adobe Commerce

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.

CVSS 3.1 · 9.1 Critical EPSS 1.4% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34107

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34106

Insecure Direct Object Reference - An attacker can able to erase the victim quote details

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34105

Stored Cross Site Scripting in Order Comment

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34104

Adobe Commerce | Improper Authorization (CWE-285)

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2024-34103

Customer account takeover via web API call & subsequent password reset

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce Webhooks Magento

CVE-2023-38218

Incorrect Authorization - Customer account takeover

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento

CVE-2022-42344

[CVE-2021-36032] Magento IDOR Leads to Account Takeover

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Adobe Magento

Products

Commerce Magento

CVE-2021-36044

Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Magento Open Source

CVE-2021-36043

Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.

CVSS 3.1 · 8 High EPSS 1.9% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Magento Open Source

CVE-2021-36042

Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

CVSS 3.1 · 9.1 Critical EPSS 2.5% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Magento Open Source

CVE-2021-36041

Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.

CVSS 3.1 · 9.1 Critical EPSS 2.4% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Magento Open Source

CVE-2021-36040

Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.

CVSS 3.1 · 9.1 Critical EPSS 2.9% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Magento Open Source

CVE-2021-36039

Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Magento Open Source