Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2024-45134

Low
2.7/10

Summary

Adobe Commerce is affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality, which may aid in further attacks. Exploitation of this issue does not require user interaction. This vulnerability affects magento/community-edition package versions through 2.4.4-p10, 2.4.5 through 2.4.5-p9, 2.4.6 through 2.4.6-p7, and 2.4.7-beta1 through 2.4.7-p2.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • HIGH
  • LOW
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published