Adobe Commerce Improper Auth Bypass (2.4.7 & prior)
CVE-2024-34104 Published on June 13, 2024

Adobe Commerce | Improper Authorization (CWE-285)
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-34104 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CVE-2024-34104 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2024-34104

Want to know whenever a new CVE is published for Adobe products? stack.watch will email you.

Adobe Commerce
 
Adobe Magento
 
Adobe Commerce Webhooks
 

Affected Versions

Adobe Commerce: adobe commerce:

Exploit Probability

EPSS
0.62%
Percentile
69.59%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.