Adobe Commerce | Improper Access Control (CWE-284)

Vulnerability

Overview CVE-2024-45122 is an Improper Access Control vulnerability in Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. The root cause is a flaw in the access control mechanism that fails to properly enforce restrictions for certain operations, allowing a low-privileged attacker to bypass intended security measures [1].

Exploitation

Prerequisites Exploitation requires a low-privileged account on the affected Adobe Commerce instance. The attacker does not need any user interaction, meaning the attack can be automated or triggered without tricking an administrator or other user [1]. The attack surface is accessible to authenticated users with minimal privileges, potentially through web requests or API calls that are not adequately validated.

Impact

Assessment Successful exploitation results in a bypass of security features, leading to a low impact on the confidentiality of the system [1]. This means the attacker could gain unauthorized access to limited sensitive information, but not full administrative control or critical data. The vulnerability does not affect integrity or availability according to the assessed CVSS vector.

Mitigation

Status Adobe has released security patches for the fixed versions: 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10. Merchants are advised to upgrade to these versions or later to remediate the vulnerability [1]. The Magento Open Source project (on which Adobe Commerce is based) provides a codebase for self-hosted users to apply fixes, though Adobe recommends using their fully supported Commerce solution [2].