Insecure Direct Object Reference (IDOR) in Create Quote Function

Vulnerability

Overview

CVE-2023-29295 is an incorrect authorization vulnerability affecting Adobe Commerce — including Magento Open Source — versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier). The root cause lies in improper authorization checks, which allow a low-privileged attacker to bypass a security feature [1].

Exploitation

The attack requires low privileges and no user interaction, making it easy to chain with other exploits or use by an authenticated user with limited permissions. The specific functionality bypassed is described as “minor,” but the lack of interaction lowers the barrier for exploitation [1].

Impact

A successful exploit results in a security feature bypass. Given the low privileges required, an attacker could escalate their capabilities within the application, potentially manipulating a feature that should be protected by authorization controls. The vulnerability is rated with a CVSS v3.1 base score of 5.4 (Medium), with network attack vector and low attack complexity [1].

Mitigation

Adobe has addressed the issue in security updates for the affected versions. Users should upgrade to Adobe Commerce 2.4.6-p1, 2.4.5-p3, 2.4.4-p4, or later. No workarounds have been published. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing [1].