Описание
Magento Open Source Improper Access Control vulnerability
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2024-34107
- https://github.com/magento/magento2/commit/30877fce83b793f71421c47347885cf076e81799
- https://github.com/magento/magento2/commit/a3c6d6e5e95e63031e4df26cfcf76feace7549c2
- https://github.com/magento/magento2/commit/c5c538810b87449886f4669cb8abbe8e5593c83c
- https://github.com/magento/magento2/commit/d10435b11ada4e502dca7539f8fd31d059d3c482
- https://helpx.adobe.com/security/products/magento/apsb24-40.html
Пакеты
magento/community-edition
= 2.4.7
Отсутствует
magento/community-edition
= 2.4.6
Отсутствует
magento/community-edition
= 2.4.5
Отсутствует
magento/community-edition
= 2.4.4
Отсутствует
magento/community-edition
>= 2.4.6-p1, < 2.4.6-p6
2.4.6-p6
magento/community-edition
>= 2.4.5-p1, < 2.4.5-p8
2.4.5-p8
magento/community-edition
< 2.4.4-p9
2.4.4-p9
Связанные уязвимости
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.
Уязвимость программных платформ для разработки и управления онлайн магазинами Magento Open Source, Adobe Commerce и плагина Adobe Commerce Webhooks, связанная с недостатками контроля доступа, позволяющая нарушителю обойти существующие ограничения безопасности