Adobe Commerce | Incorrect Authorization (CWE-863)

Vulnerability

Overview

CVE-2024-45132 is an Improper Authorization vulnerability in Adobe Commerce that affects versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier [1]. The root cause is insufficient enforcement of authorization checks, which allows a low-privileged authenticated attacker to escalate privileges [1].

Attack

Vector

To exploit this vulnerability, an attacker must have low-privileged access to an affected Adobe Commerce instance [1]. The attack can be carried out over the network, and no user interaction is required for exploitation, making it straightforward for an authenticated adversary to attempt privilege escalation [1].

Impact

Successful exploitation enables the attacker to bypass existing security measures and affect the confidentiality of the system [1]. While the immediate impact is on confidentiality, privilege escalation could lead to broader access to sensitive data stored within the e-commerce platform.

Mitigation

Adobe has addressed this vulnerability in the following releases: 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10, though the advisory notes that earlier versions remain affected [1]. Users are strongly advised to upgrade to the latest patched version of Adobe Commerce or apply the appropriate security update. Adobe Commerce is part of the Magento project, with source code available on GitHub [2].