CVE-2024-39405: adobe adobe commerce Improper Authorization

Vulnerability summary

CVE-2024-39405 is a medium (CVSS 4.3) Improper Authorization vulnerability in adobe adobe commerce. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.8% of scored vulnerabilities.

Timeline

1. 14-08-2024
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.