CVE-2024-45148: Adobe Commerce | Improper Authentication (CWE-287)

Published Oct 10, 2024

Updated

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction.

Affected Software

116 affected components

Adobe Commerce

Adobe Commerce=2.3.7

Adobe Commerce=2.3.7-p1

Adobe Commerce=2.3.7-p2

Adobe Commerce=2.3.7-p3

Adobe Commerce=2.3.7-p4

Adobe Commerce=2.3.7-p4-ext1

Adobe Commerce=2.3.7-p4-ext2

Adobe Commerce=2.3.7-p4-ext3

Adobe Commerce=2.3.7-p4-ext4

Adobe Commerce=2.4.0

Adobe Commerce=2.4.0-ext-1

Adobe Commerce=2.4.0-ext-2

Adobe Commerce=2.4.0-ext-3

Adobe Commerce=2.4.0-ext-4

Adobe Commerce=2.4.1

Adobe Commerce=2.4.1-ext-1

Adobe Commerce=2.4.1-ext-2

Adobe Commerce=2.4.1-ext-3

Adobe Commerce=2.4.1-ext-4

Adobe Commerce=2.4.2

Adobe Commerce=2.4.2-ext-1

Adobe Commerce=2.4.2-ext-2

Adobe Commerce=2.4.2-ext-3

Adobe Commerce=2.4.2-ext-4

Adobe Commerce=2.4.2-p1

Adobe Commerce=2.4.2-p2

Adobe Commerce=2.4.3

Adobe Commerce=2.4.3-ext-1

Adobe Commerce=2.4.3-ext-2

Adobe Commerce=2.4.3-ext-3

Adobe Commerce=2.4.3-ext-4

Adobe Commerce=2.4.3-p1

Adobe Commerce=2.4.3-p2

Adobe Commerce=2.4.4

Adobe Commerce=2.4.4-p1

Adobe Commerce=2.4.4-p10

Adobe Commerce=2.4.4-p2

Adobe Commerce=2.4.4-p3

Adobe Commerce=2.4.4-p4

Adobe Commerce=2.4.4-p5

Adobe Commerce=2.4.4-p6

Adobe Commerce=2.4.4-p7

Adobe Commerce=2.4.4-p8

Adobe Commerce=2.4.4-p9

Adobe Commerce=2.4.5

Adobe Commerce=2.4.5-p1

Adobe Commerce=2.4.5-p2

Adobe Commerce=2.4.5-p3

Adobe Commerce=2.4.5-p4

Adobe Commerce=2.4.5-p5

Adobe Commerce=2.4.5-p6

Adobe Commerce=2.4.5-p7

Adobe Commerce=2.4.5-p8

Adobe Commerce=2.4.5-p9

Adobe Commerce=2.4.6

Adobe Commerce=2.4.6-p1

Adobe Commerce=2.4.6-p2

Adobe Commerce=2.4.6-p3

Adobe Commerce=2.4.6-p4

Adobe Commerce=2.4.6-p5

Adobe Commerce=2.4.6-p6

Adobe Commerce=2.4.6-p7

Adobe Commerce=2.4.7

Adobe Commerce=2.4.7-b1

Adobe Commerce=2.4.7-b2

Adobe Commerce=2.4.7-p1

Adobe Commerce=2.4.7-p2

Adobe Commerce B2b=1.3.3

Adobe Commerce B2b=1.3.3-p10

Adobe Commerce B2b=1.3.4

Adobe Commerce B2b=1.3.4-p9

Adobe Commerce B2b=1.3.5

Adobe Commerce B2b=1.3.5-p7

Adobe Commerce B2b=1.4.2

Adobe Commerce B2b=1.4.2-p1

Adobe Commerce B2b=1.4.2-p2

Adobe Magento

Adobe Magento=2.4.3

Adobe Magento=2.4.4

Adobe Magento=2.4.4-p1

Adobe Magento=2.4.4-p10

Adobe Magento=2.4.4-p2

Adobe Magento=2.4.4-p3

Adobe Magento=2.4.4-p4

Adobe Magento=2.4.4-p5

Adobe Magento=2.4.4-p6

Adobe Magento=2.4.4-p7

Adobe Magento=2.4.4-p8

Adobe Magento=2.4.4-p9

Adobe Magento=2.4.5

Adobe Magento=2.4.5-p1

Adobe Magento=2.4.5-p2

Adobe Magento=2.4.5-p3

Adobe Magento=2.4.5-p4

Adobe Magento=2.4.5-p5

Adobe Magento=2.4.5-p6

Adobe Magento=2.4.5-p7

Adobe Magento=2.4.5-p8

Adobe Magento=2.4.5-p9

Adobe Magento=2.4.6

Adobe Magento=2.4.6-p1

Adobe Magento=2.4.6-p2

Adobe Magento=2.4.6-p3

Adobe Magento=2.4.6-p4

Adobe Magento=2.4.6-p5

Adobe Magento=2.4.6-p6

Adobe Magento=2.4.6-p7

Adobe Magento=2.4.7

Adobe Magento=2.4.7-b1

Adobe Magento=2.4.7-p1

Adobe Magento=2.4.7-p2

Event History

Oct 10, 2024

CVE Published

via MITRE·09:57 AM

Data Sourced

via MITRE·09:57 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-45148?

CVE-2024-45148 is classified as a low severity vulnerability that can lead to improper authentication in Adobe Commerce.

How do I fix CVE-2024-45148?

To remediate CVE-2024-45148, update to the latest secure versions of Adobe Commerce provided by Adobe.

What versions of Adobe Commerce are affected by CVE-2024-45148?

CVE-2024-45148 affects Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.

Who is impacted by CVE-2024-45148?

Low-privileged attackers who exploit this vulnerability can gain unauthorized access to Adobe Commerce instances.

Is my Adobe Magento Open Source vulnerable to CVE-2024-45148?

Yes, Adobe Magento Open Source versions that match the affected versions are also vulnerable to CVE-2024-45148.