Skip to main content

Improper Authorization

CVE-2024-39404

Medium
4.3/10

Summary

Adobe Commerce versions through 2.4.4-p9, 2.4.5 through 2.4.5-p8, 2.4.6 through 2.4.6-p6, 2.4.7-beta1 through 2.4.7-p1 and magento/project-community-edition versions through 2.0.2 are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • NONE

CWE-285 - Improper Authorization

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References

Advisory Timeline

  • Published