Adobe Commerce Guest Cart Shipping Address Overwrite IDOR

Vulnerability

Overview

CVE-2023-29290 is an Incorrect Authorization vulnerability affecting Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier) [1]. The root cause lies in improper authorization checks, which can be exploited to bypass security controls. This flaw does not require user interaction, making it potentially easy for an attacker to exploit [1].

Exploitation and

Attack Surface

An attacker can leverage this vulnerability to bypass a minor functionality [1]. Exploitation does not require user interaction, meaning an attacker can trigger the flaw without any action from the victim. The attack surface is limited to bypassing a security feature, but the exact nature of the bypass and the attack vector (e.g., network, local) are not fully detailed in public sources [1]. The official advisory does not provide CVSS vector strings or exploitable conditions beyond the basic description [1].

Impact

Successful exploitation results in a security feature bypass, allowing the attacker to circumvent a minor functionality [1]. The impact is described as minor, suggesting a limited security control is affected rather than a critical data access or privilege escalation. No additional impact details, such as data confidentiality, integrity, or availability, are provided in the available references [1].

Mitigation

Status

Adobe has not released a specific security update for this CVE in the referenced advisory; however, it is addressed in the Adobe Commerce security bulletin for June 2023 (APSB23-35). Affected users should apply the latest security patches for their respective Adobe Commerce or Magento Open Source installations [2]. At the time of writing, this CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The vendor's GitHub repository provides general instructions for reporting and addressing security issues [2].