Adobe Commerce | Improper Access Control (CWE-284)

Vulnerability

Overview

CVE-2024-45135 is an Improper Access Control vulnerability in Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier [1]. The root cause is insufficient enforcement of access controls on certain administrative actions, allowing an attacker with admin privileges to bypass intended security measures [1].

Exploitation

An attacker who already has administrative access to an Adobe Commerce instance can exploit this flaw without any user interaction [1]. The attack vector does not require tricking a higher-privileged user; the attacker simply leverages their existing admin role to perform unauthorized operations that the access control policy was designed to prevent [1].

Impact

Successful exploitation results in a low impact on integrity [1]. The attacker may be able to modify configuration settings, templates, or other administrative resources that should be protected by additional access restrictions [1]. This could lead to unauthorized changes in the store's behavior or appearance, though the low integrity rating suggests the scope of manipulation is limited.

Mitigation

Adobe has released security updates to address this vulnerability in the affected versions: 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10 [1]. Merchants are strongly advised to upgrade to the latest patched versions. The open-source Magento project provides the codebase on GitHub [2], and administrators should apply the updates as soon as possible.