Adobe Commerce | Improper Access Control (CWE-284)

Vulnerability

Overview

CVE-2024-45124 is an Improper Access Control vulnerability affecting Adobe Commerce versions 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2, and earlier. The flaw stems from inadequate enforcement of access restrictions on certain functions or resources, enabling a security feature bypass [1].

Exploitation

Conditions

An attacker can exploit this vulnerability without any user interaction and without requiring elevated privileges. The network-based attack vector suggests the issue is exploitable remotely, with low attack complexity [1].

Impact

Assessment

Successful exploitation allows an attacker to bypass security measures, resulting in a low impact on integrity. There is no indication of impact to confidentiality or availability. This means an attacker could potentially modify certain data or settings without proper authorization, but the scope of modification is limited [1].

Remediation

Adobe has addressed this vulnerability in security updates for the affected versions. Users are strongly advised to update their Adobe Commerce installations to the latest patched versions. For environments where immediate patching is not feasible, administrators should review access controls and monitor for unusual activity that could indicate exploitation attempts [1].