CVE-2022-35689

Adobe Commerce Improper Access Control Security feature bypass

View on CVE.org

Published Oct 14, 2022 CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed

Description

Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Adobe

Magento Commerce

affected

Version	Status	Constraints
`unspecified`	affected	≤ 2.4.5
`unspecified`	affected	≤ 2.4.4-p1
`unspecified`	affected	≤ None

Configuration 1 [-]

OR	cpe:2.3:a:adobe:commerce::::::::
	cpe:2.3:a:adobe:commerce:2.4.4:-::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.5:-::::::
	cpe:2.3:a:adobe:magento_open_source::::::::
	cpe:2.3:a:adobe:magento_open_source:2.4.4:-::::::
	cpe:2.3:a:adobe:magento_open_source:2.4.4:p1::::::
	cpe:2.3:a:adobe:magento_open_source:2.4.5:-::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-38565	Magento Open Source allows Improper Access Control
Github GHSA	GHSA-5fxx-jwjm-x9hj	Magento Open Source allows Improper Access Control

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.4% (1.439% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://helpx.adobe.com/security/products/magento/apsb22-48.html

History

Apr 23, 2025 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Subscriptions

Adobe Commerce Magento Open Source

Weaknesses

Sources

CVE record Updated: Apr 23, 2025, 4:47 PM

Status: PUBLISHED
Assigner: adobe
Published: Oct 14, 2022, 7:48 PM
Updated: Apr 23, 2025, 4:47 PM
Reserved: Jul 12, 2022, 12:00 AM

View source JSON

Vulnrichment Updated: Aug 3, 2024, 9:36 AM

Updated: Aug 3, 2024, 9:36 AM

NVD Updated: Jun 17, 2026, 4:52 AM

Status: Modified
Published: Oct 14, 2022, 8:15 PM
Modified: Jun 17, 2026, 4:52 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-35689", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "datePublished": "2022-10-14T19:48:16.881Z", "dateUpdated": "2025-04-23T16:47:08.939Z", "dateReserved": "2022-07-12T00:00:00.000Z"}, "containers": {"cna": {"title": "Adobe Commerce Improper Access Control Security feature bypass", "datePublic": "2022-08-09T00:00:00.000Z", "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2022-10-14T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction."}], "affected": [{"vendor": "Adobe", "product": "Magento Commerce", "versions": [{"version": "unspecified", "lessThanOrEqual": "2.4.5", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "2.4.4-p1", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "None", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-48.html"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "Improper Access Control (CWE-284)", "cweId": "CWE-284"}]}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:36:44.451Z"}, "title": "CVE Program Container", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-48.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T13:05:52.428328Z", "id": "CVE-2022-35689", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:47:08.939Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-48.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:36:44.451Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-35689", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T13:05:52.428328Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T13:05:54.013Z"}}], "cna": {"title": "Adobe Commerce Improper Access Control Security feature bypass", "source": {"discovery": "EXTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Adobe", "product": "Magento Commerce", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "2.4.5"}, {"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "2.4.4-p1"}, {"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "None"}]}], "datePublic": "2022-08-09T00:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-48.html"}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Control (CWE-284)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2022-10-14T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-35689", "state": "PUBLISHED", "dateUpdated": "2025-04-23T16:47:08.939Z", "dateReserved": "2022-07-12T00:00:00.000Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2022-10-14T19:48:16.881Z", "assignerShortName": "adobe"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Magento Commerce", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2.4.5", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "2.4.4-p1", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "None", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "76AAB57F-7723-44E0-B91A-9F120C849AC4", "versionEndExcluding": "2.4.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*", "matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*", "matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBE7069F-C3EE-46F1-85C4-4EC858C49E07", "versionEndExcluding": "2.4.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.4:-:*:*:*:*:*:*", "matchCriteriaId": "D6340732-571E-468C-9834-A8B2FCB5F5B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.4:p1:*:*:*:*:*:*", "matchCriteriaId": "E2D8E4EA-9756-4F9B-BB73-A3EE9C3006FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.5:-:*:*:*:*:*:*", "matchCriteriaId": "684E82D1-7BE3-4D47-9B19-935ED6EC6D62", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction."}, {"lang": "es", "value": "Adobe Commerce versiones 2.4.4-p1 (y anteriores) y 2.4.5 (y anteriores) est\u00e1n afectadas por una vulnerabilidad de Control de Acceso Inapropiado que podr\u00eda resultar en una omisi\u00f3n de la funcionalidad de Seguridad. Un atacante podr\u00eda aprovechar esta vulnerabilidad para afectar a la disponibilidad de una caracter\u00edstica menor de un usuario. No es requerida una interacci\u00f3n del usuario para la explotaci\u00f3n de este problema"}], "id": "CVE-2022-35689", "lastModified": "2026-06-17T04:52:04.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-35689", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T13:05:52.428328Z", "version": "2.0.3"}}]}, "published": "2022-10-14T20:15:10.223", "references": [{"source": "psirt@adobe.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-48.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-48.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@adobe.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}