CVE-2024-20716

Force high-usage of resources by generating unlimited coupons: Adobe Commerce

Description

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust system resources, causing the application to slow down or crash. Exploitation of this issue does not require user interaction.

Scores

Weaknesses (CWE)

• CWE-400

Advisories

• GHSA-c9h9-h5gf-885r — Magento Open Source allows Uncontrolled Resource Consumption

European references

• ENISA EUVD · EUVD-2024-18431
• GCVE · GCVE-0-2024-20716

CERT-FR advisories

• CERTFR-2024-AVI-0123 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*

Affected products

References

• https://helpx.adobe.com/security/products/magento/apsb24-03.html

Sources