CVE-2024-34107: Adobe Commerce | Improper Access Control (CWE-284)

First published: Thu Jun 13 2024(Updated: )

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

Credit: psirt@adobe.com psirt@adobe.com

Affected Software	Affected Version	How to fix
Adobe Commerce	=2.3.7
Adobe Commerce	=2.3.7-p1
Adobe Commerce	=2.3.7-p2
Adobe Commerce	=2.3.7-p3
Adobe Commerce	=2.3.7-p4
Adobe Commerce	=2.3.7-p4-ext1
Adobe Commerce	=2.3.7-p4-ext2
Adobe Commerce	=2.3.7-p4-ext3
Adobe Commerce	=2.3.7-p4-ext4
Adobe Commerce	=2.4.0
Adobe Commerce	=2.4.0-ext-1
Adobe Commerce	=2.4.0-ext-2
Adobe Commerce	=2.4.0-ext-3
Adobe Commerce	=2.4.0-ext-4
Adobe Commerce	=2.4.1
Adobe Commerce	=2.4.1-ext-1
Adobe Commerce	=2.4.1-ext-2
Adobe Commerce	=2.4.1-ext-3
Adobe Commerce	=2.4.1-ext-4
Adobe Commerce	=2.4.2
Adobe Commerce	=2.4.2-ext-1
Adobe Commerce	=2.4.2-ext-2
Adobe Commerce	=2.4.2-ext-3
Adobe Commerce	=2.4.2-ext-4
Adobe Commerce	=2.4.3
Adobe Commerce	=2.4.3-ext-1
Adobe Commerce	=2.4.3-ext-2
Adobe Commerce	=2.4.3-ext-3
Adobe Commerce	=2.4.3-ext-4
Adobe Commerce	=2.4.4
Adobe Commerce	=2.4.4-p1
Adobe Commerce	=2.4.4-p2
Adobe Commerce	=2.4.4-p3
Adobe Commerce	=2.4.4-p4
Adobe Commerce	=2.4.4-p5
Adobe Commerce	=2.4.4-p6
Adobe Commerce	=2.4.5
Adobe Commerce	=2.4.5-p1
Adobe Commerce	=2.4.5-p2
Adobe Commerce	=2.4.5-p3
Adobe Commerce	=2.4.5-p4
Adobe Commerce	=2.4.5-p5
Adobe Commerce	=2.4.6
Adobe Commerce	=2.4.6-p1
Adobe Commerce	=2.4.6-p2
Adobe Commerce	=2.4.6-p3
Adobe Commerce Webhooks	>=1.2.0<=1.4.0
Adobe Magento	=2.4.4
Adobe Magento	=2.4.4-p1
Adobe Magento	=2.4.4-p2
Adobe Magento	=2.4.4-p3
Adobe Magento	=2.4.4-p4
Adobe Magento	=2.4.4-p5
Adobe Magento	=2.4.4-p6
Adobe Magento	=2.4.4-p7
Adobe Magento	=2.4.4-p8
Adobe Magento	=2.4.5
Adobe Magento	=2.4.5-p1
Adobe Magento	=2.4.5-p2
Adobe Magento	=2.4.5-p3
Adobe Magento	=2.4.5-p4
Adobe Magento	=2.4.5-p5
Adobe Magento	=2.4.5-p6
Adobe Magento	=2.4.5-p7
Adobe Magento	=2.4.6
Adobe Magento	=2.4.6-p1
Adobe Magento	=2.4.6-p2
Adobe Magento	=2.4.6-p3
Adobe Magento	=2.4.6-p4
Adobe Magento	=2.4.6-p5
Adobe Magento	=2.4.7-b1
composer/magento/community-edition	<2.4.4-p9	2.4.4-p9
composer/magento/community-edition	>=2.4.5-p1<2.4.5-p8	2.4.5-p8
composer/magento/community-edition	>=2.4.6-p1<2.4.6-p6	2.4.6-p6
composer/magento/community-edition	=2.4.4
composer/magento/community-edition	=2.4.5
composer/magento/community-edition	=2.4.6
composer/magento/community-edition	=2.4.7

Never miss a vulnerability like this again

Reference Links

agent/weakness
agent/title
agent/type
agent/first-publish-date
agent/severity
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/description
collector/github-advisory-latest
source/GitHub
alias/GHSA-r7cm-g469-wm4g
alias/CVE-2024-34107
agent/references
agent/last-modified-date
agent/softwarecombine
agent/event
collector/nvd-cve
agent/author
agent/tags
collector/mitre-cve
source/MITRE
collector/github-advisory
vendor/adobe
canonical/adobe commerce
version/adobe commerce/2.3.7
version/adobe commerce/2.3.7-p1
version/adobe commerce/2.3.7-p2
version/adobe commerce/2.3.7-p3
version/adobe commerce/2.3.7-p4
version/adobe commerce/2.3.7-p4-ext1
version/adobe commerce/2.3.7-p4-ext2
version/adobe commerce/2.3.7-p4-ext3
version/adobe commerce/2.3.7-p4-ext4
version/adobe commerce/2.4.0
version/adobe commerce/2.4.0-ext-1
version/adobe commerce/2.4.0-ext-2
version/adobe commerce/2.4.0-ext-3
version/adobe commerce/2.4.0-ext-4
version/adobe commerce/2.4.1
version/adobe commerce/2.4.1-ext-1
version/adobe commerce/2.4.1-ext-2
version/adobe commerce/2.4.1-ext-3
version/adobe commerce/2.4.1-ext-4
version/adobe commerce/2.4.2
version/adobe commerce/2.4.2-ext-1
version/adobe commerce/2.4.2-ext-2
version/adobe commerce/2.4.2-ext-3
version/adobe commerce/2.4.2-ext-4
version/adobe commerce/2.4.3
version/adobe commerce/2.4.3-ext-1
version/adobe commerce/2.4.3-ext-2
version/adobe commerce/2.4.3-ext-3
version/adobe commerce/2.4.3-ext-4
version/adobe commerce/2.4.4
version/adobe commerce/2.4.4-p1
version/adobe commerce/2.4.4-p2
version/adobe commerce/2.4.4-p3
version/adobe commerce/2.4.4-p4
version/adobe commerce/2.4.4-p5
version/adobe commerce/2.4.4-p6
version/adobe commerce/2.4.5
version/adobe commerce/2.4.5-p1
version/adobe commerce/2.4.5-p2
version/adobe commerce/2.4.5-p3
version/adobe commerce/2.4.5-p4
version/adobe commerce/2.4.5-p5
version/adobe commerce/2.4.6
version/adobe commerce/2.4.6-p1
version/adobe commerce/2.4.6-p2
version/adobe commerce/2.4.6-p3
canonical/adobe commerce webhooks
version/adobe commerce webhooks/1.2.0
version/adobe commerce webhooks/1.4.0
canonical/adobe magento
version/adobe magento/2.4.4
version/adobe magento/2.4.4-p1
version/adobe magento/2.4.4-p2
version/adobe magento/2.4.4-p3
version/adobe magento/2.4.4-p4
version/adobe magento/2.4.4-p5
version/adobe magento/2.4.4-p6
version/adobe magento/2.4.4-p7
version/adobe magento/2.4.4-p8
version/adobe magento/2.4.5
version/adobe magento/2.4.5-p1
version/adobe magento/2.4.5-p2
version/adobe magento/2.4.5-p3
version/adobe magento/2.4.5-p4
version/adobe magento/2.4.5-p5
version/adobe magento/2.4.5-p6
version/adobe magento/2.4.5-p7
version/adobe magento/2.4.6
version/adobe magento/2.4.6-p1
version/adobe magento/2.4.6-p2
version/adobe magento/2.4.6-p3
version/adobe magento/2.4.6-p4
version/adobe magento/2.4.6-p5
version/adobe magento/2.4.7-b1
package-manager/composer

CVE-2024-34107: Adobe Commerce | Improper Access Control (CWE-284)

Never miss a vulnerability like this again

Reference Links

Company

Resources

Contact