Adobe Commerce | Improper Access Control (CWE-284)

CVE-2024-45129 is an Improper Access Control vulnerability in Adobe Commerce that affects versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier [1]. The root cause is insufficient access control checks, allowing a low-privileged attacker to bypass intended security measures.

Exploitation does not require user interaction and can be carried out by an authenticated attacker with low privileges [1]. The attack complexity is low, and the attacker can trigger the vulnerability through crafted requests.

Successful exploitation results in privilege escalation, with a low impact on integrity [1]. The attacker may gain unauthorized access to restricted functionality or data.

Adobe has released security updates to address this issue. Users are advised to upgrade to the latest supported versions to mitigate the risk [1]. No workarounds have been published.