CVE-2024-45148
Adobe Commerce | Improper Authentication (CWE-287)
At a glance Severity HIGH 8.8 EPSS EPSS 0.73 % · percentile 54 (2026-10-27) State PUBLISHED Published 2024-10-10 Updated 2024-10-10 Assigner adobe NVD status Analyzed Description Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H adobe CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · psirt@adobe.com (Secondary) CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*+76 more Affected products
References
Sources
