CVE-2024-39404
A user without Shop Policy Parameters section privilege can alter the shop policy parameters section
At a glance Severity MEDIUM 4.3 EPSS EPSS 0.46 % · percentile 39 (2026-10-27) State PUBLISHED Published 2024-08-14 Updated 2024-08-14 Assigner adobe NVD status Analyzed Description Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N adobe CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N NVD · psirt@adobe.com (Secondary)
Weaknesses (CWE)
Advisories
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* ≤ 2.4.3cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.6:p6:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.7:b1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.7:b2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.7:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:* ≤ 2.4.3cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*+22 more Affected products
References
Sources
