Adobe Commerce | Incorrect Authorization (CWE-863)

Vulnerability

Overview CVE-2024-45131 is an Improper Authorization vulnerability in Adobe Commerce, affecting versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier. The root cause lies in insufficient authorization checks, which can be exploited by a low-privileged attacker to bypass intended security restrictions [1].

Exploitation

Conditions An attacker must have low-privileged access to the system, but no user interaction is required for exploitation. This makes the vulnerability particularly dangerous as it can be triggered programmatically or through automated means without relying on social engineering [1].

Impact

Successful exploitation results in a bypass of security features, leading to a low impact on both confidentiality and integrity. While the impact is limited, it could enable further attacks or unauthorized access to sensitive data [1].

Mitigation

Adobe has released security updates to address this issue. Users are advised to upgrade to the latest patched versions: 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, or later. No workarounds have been disclosed [1].