CVE-2025-27207

Adobe Commerce | Improper Access Control (CWE-284)

Description

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

Scores

Faiblesses (CWE)

• CWE-284

Références européennes

• ENISA EUVD · EUVD-2025-17707
• GCVE · GCVE-0-2025-27207

Avis du CERT-FR

• CERTFR-2025-AVI-0495 — Multiples vulnérabilités dans les produits Adobe · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:adobe:commerce_b2b:1.3.3:-:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.3:p12:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.3:p13:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.4:-:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.4:p11:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.4:p12:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.5:-:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.5:p10:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.5:p7:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.5:p8:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.3.5:p9:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.4.2:-:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.4.2:p2:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.4.2:p3:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.4.2:p4:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.4.2:p5:*:*:*:*:*:*
• cpe:2.3:a:adobe:commerce_b2b:1.5.2:-:*:*:*:*:*:*

Produits affectés

Références

• https://helpx.adobe.com/security/products/magento/apsb25-50.html

Sources