CVE-2025-27189: adobe adobe commerce Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2025-27189 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in adobe adobe commerce. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63% of scored vulnerabilities.

Timeline

1. 08-04-2025
   PublishedVulnerability first disclosed.
2. 08-04-2025
   Last modifiedVulnerability information updated.

Description

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.