CVE-2025-24423: Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to modify select data. Exploitation of this issue does not require user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24423?
CVE-2025-24423 is classified as a low-severity vulnerability affecting certain versions of Adobe Commerce.
How do I fix CVE-2025-24423?
To remediate CVE-2025-24423, upgrade to a version of Adobe Commerce that is not impacted, specifically versions later than 2.4.7-beta1.
Who is affected by CVE-2025-24423?
CVE-2025-24423 impacts Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier.
What type of vulnerability is CVE-2025-24423?
CVE-2025-24423 is an Improper Access Control vulnerability that may allow privilege escalation.
Can CVE-2025-24423 be exploited by low-privileged attackers?
Yes, a low-privileged attacker can exploit CVE-2025-24423 to bypass security measures and gain unauthorized access.