Adobe Commerce | Incorrect Authorization (CWE-863)

CVE-2023-29288 is an incorrect authorization vulnerability in Adobe Commerce (and Magento Open Source) affecting versions 2.4.6, 2.4.5-p2, 2.4.4-p3, and earlier [1]. The flaw allows a privileged attacker to bypass security features and modify a minor functionality of another user's data.

Exploitation requires a privileged account, meaning the attacker must already have some level of access to the system. However, no user interaction is needed, making it easier to exploit once the attacker has the necessary privileges [1]. The attack vector is likely through the admin panel or API endpoints that fail to properly enforce authorization checks.

Successful exploitation could lead to unauthorized modification of another user's data, potentially affecting data integrity and trust in the application. While described as 'minor functionality,' the exact scope may vary depending on the deployment [1].

Adobe has not released a specific security bulletin in the provided references, but the Magento Open Source repository [2] indicates ongoing development. Users should monitor Adobe's security advisories and upgrade to the latest patched versions when available. As a general precaution, restrict privileged access and review authorization configurations.