CVE-2024-45120: adobe adobe commerce

Vulnerability summary

CVE-2024-45120 is a low (CVSS 3.1) vulnerability in adobe adobe commerce. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.6% of scored vulnerabilities.

Timeline

1. 10-10-2024
   PublishedVulnerability first disclosed.
2. 12-12-2024
   Last modifiedVulnerability information updated.

Description

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use of a resource, having a low impact on integrity. Exploitation of this issue requires user interaction.

• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.