CVE-2025-24407
Adobe Commerce | Incorrect Authorization (CWE-863)
En bref Sévérité HIGH 7.1 EPSS EPSS 0.79 % · centile 56 (2026-10-27) État PUBLISHED Publiée 2025-02-11 Mise à jour 2025-03-17 Attribuée par adobe Statut NVD Analyzed Description Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N adobe CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N NVD · psirt@adobe.com (Secondary) CVSS 3.1 HIGH 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:* < 1.3.3cpe:2.3:a:adobe:commerce_b2b:1.3.3:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.5:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.5:p7:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.3.5:p8:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.4.2:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce_b2b:1.5.0:*:*:*:*:*:*:*Produits affectés
Références
Sources
