Adobe Commerce | Improper Access Control (CWE-284)

CVE-2024-45133 is an information exposure vulnerability affecting Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier [1]. The flaw resides in the software's access control mechanisms where sensitive data is improperly disclosed to authenticated users with administrative privileges [1]. This exposure stems from insufficient validation of request parameters or improper handling of output, allowing the sensitive information to be leaked during standard admin operations.

Exploitation and

Attack Surface An attacker must already possess administrative credentials to exploit this vulnerability, meaning the attack surface is limited to authenticated admin users [1]. The exploitation does not require any additional user interaction [1]. The vulnerability can be leveraged over the network by crafting specific API calls or HTTP requests that trigger the information leak [1]. While authentication is required, the low complexity of the attack vector makes it a viable stepping stone for broader intrusions.

Impact

The primary impact is on confidentiality, as the attacker can read sensitive data that should be restricted, such as configuration parameters or other internal details [1]. This information exposure enables a security feature bypass, allowing the attacker to circumvent access controls that normally protect certain resources [1]. Although the direct confidentiality impact is considered low, the leaked information can be used to plan and execute more severe attacks, such as privilege escalation or data theft [1].

Mitigation

Adobe has addressed this vulnerability in the latest patched releases of Adobe Commerce. Users should update to the versions specified in Adobe's security bulletin to apply the fix [1]. As of publication, there is no evidence of active exploitation in the wild, but the vulnerability is relevant for administrators managing Adobe Commerce installations.