CVE-2023-38209

Опубликовано: 09 авг. 2023

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.

Ссылки

https://helpx.adobe.com/security/products/magento/apsb23-42.html
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb23-42.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*

Версия до 2.4.4 (исключая)

cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00132

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-863

Связанные уязвимости

GHSA-3vg2-v639-6ch9

CVSS3: 6.5

github

больше 2 лет назад

Magento Open Source allows Incorrect Authorization

BDU:2023-06022

CVSS3: 7.6

fstec