Adobe Commerce Improper Access Control Security feature bypass

Root

Cause CVE-2022-35689 is an Improper Access Control vulnerability in Adobe Commerce affecting versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier). The improper access controls allow a security feature bypass, meaning that the intended protections or restrictions on certain functionality are not correctly enforced [1].

Exploitation

Exploitation does not require user interaction, so an attacker can trigger the vulnerability remotely without any action from the victim. The exact attack vector is not detailed, but given the nature of the flaw, an attacker would likely be able to access or manipulate features that should have been restricted, by sending crafted requests to the application [1].

Impact

An attacker leveraging this vulnerability can impact the availability of a user's minor feature. While the impact is described as affecting a 'minor feature,' it still constitutes a security bypass in an e-commerce platform. No privilege escalation or data theft is described, but the denial of a feature could disrupt normal store operations or user experience [1].

Mitigation

Adobe has addressed this vulnerability in security releases. Users should update their Adobe Commerce or Magento Open Source installations to the latest patched versions as recommended in Adobe's security bulletin [2]. As of the publication date, no workarounds have been published, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.