CVE-2024-20718: adobe adobe commerce Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2024-20718 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in adobe adobe commerce. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.7% of scored vulnerabilities.

Timeline

1. 15-02-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.