CVE-2023-38220

Full page cache enumeration via cookie X-Magento-Vary

Published Oct 13, 2023 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-42040 Magento Open Source allows Improper Authorization
Github GHSA Github GHSA GHSA-grc6-r6f8-xj7c Magento Open Source allows Improper Authorization
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
adobe
Published
Updated
Feb 27, 2025, 8:40 PM
Reserved
Jul 13, 2023, 4:21 PM
Status
Modified
Published
Oct 13, 2023, 7:15 AM
Modified
Jun 17, 2026, 6:09 AM