Adobe Commerce | Incorrect Authorization (CWE-863)

Vulnerability

Overview CVE-2024-45128 is an Improper Authorization vulnerability in Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. The root cause is a failure to properly enforce authorization checks, which can lead to a security feature bypass [1].

Attack

Vector A low-privileged attacker can exploit this flaw by sending specially crafted requests to the affected Adobe Commerce instance. No user interaction is required, and the attack does not require any special network access beyond typical application access [1].

Impact

Successful exploitation results in a bypass of intended security controls. The impact is rated as low for integrity and availability, meaning an attacker could potentially manipulate certain data or cause limited service disruption [1].

Mitigation

Adobe has not released a patch at the time of publication. The vendor's advisory and the project's GitHub repository (for Magento Open Source, the upstream project) are referenced for future updates [2].