Being able to import/export tax rates without proper privileges

CVE-2024-39414 is an Improper Authorization vulnerability in Adobe Commerce. The issue affects versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9, and earlier. The root cause is a flaw in the authorization mechanism that fails to properly enforce access controls for certain sensitive operations or data [1].

Exploitation

A low-privileged authenticated attacker can exploit this vulnerability by sending specially crafted requests to the vulnerable Adobe Commerce instance. No user interaction is required for exploitation, and the attacker does not need any special privileges beyond their existing low-privileged account [1]. The attack vector is network-based and requires some technical skill to craft the necessary requests.

Impact

Successful exploitation results in a security feature bypass, allowing the attacker to disclose minor information that would normally be protected. The impact is limited to information disclosure of potentially sensitive but low-severity data, such as configuration details or non-critical user information [1].

Mitigation

Adobe has released security patches for this vulnerability as part of their regular security bulletin. Users should upgrade to the latest patched versions of Adobe Commerce or Magento Open Source as recommended by Adobe. The open-source codebase is available on GitHub for review [2]. No workarounds have been publicly documented, so applying the official patch is the primary mitigation.