Adobe Commerce Improper Authorization Privilege escalation (Adobe Magento Commerce)
En bref
- Source
- NVD
- EPSS
- EPSS 2.15 % · centile 82 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- adobe
- Statut NVD
- Modified
Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
Faiblesses (CWE)
- CWE-285 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | adobe |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-r7mm-grf3-5fjv — Magento Improper Authorization vulnerability
Références européennes
- ENISA EUVD · EUVD-2022-6615
- GCVE · GCVE-0-2022-34256
Avis du CERT-FR
- CERTFR-2022-AVI-726 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*≥ 2.3.0 < 2.3.7cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*≥ 2.4.0 < 2.4.3cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*≥ 2.3.0 < 2.3.7cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*≥ 2.4.0 < 2.4.3cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.7:p3:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.3:p2:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.4:-:*:*:commerce:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.4 ; affected unspecified ≤ 2.3.7-p3 ; affected unspecified ≤ 2.4.3-p2 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |