CVE-2024-49521: Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49521?
CVE-2024-49521 has a low severity rating, but it can still lead to significant security feature bypasses.
How do I fix CVE-2024-49521?
To fix CVE-2024-49521, upgrade your Adobe Commerce or Magento to version 3.2.6 or later.
Who is affected by CVE-2024-49521?
CVE-2024-49521 affects Adobe Commerce versions 3.2.5 and earlier, as well as Magento Open Source versions 3.2.5 and earlier.
What type of vulnerability is CVE-2024-49521?
CVE-2024-49521 is a Server-Side Request Forgery (SSRF) vulnerability.
What could an attacker achieve by exploiting CVE-2024-49521?
An attacker could potentially send crafted requests from the vulnerable server to internal systems, bypassing security features.