CVE-2025-43585: Magento Improper Authorization leading to security feature bypass
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access leading to a limited impact to confidentiality and a high impact to integrity. Exploitation of this issue does not require user interaction.
Other sources
Magento Improper Authorization leading to security feature bypass
— Packagist
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access leading to a limited impact to confidentiality and a high impact to integrity. Exploitation of this issue does not require user interaction.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p13 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p11 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p6
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43585?
CVE-2025-43585 has a critical severity rating as it allows unauthorized access and security feature bypass.
How do I fix CVE-2025-43585?
To mitigate CVE-2025-43585, upgrade Adobe Commerce to version 2.4.5-p13 or later.
Which versions of Adobe Commerce are affected by CVE-2025-43585?
CVE-2025-43585 affects Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier.
What kind of attack can exploit CVE-2025-43585?
An attacker can exploit CVE-2025-43585 to bypass security measures and gain unauthorized access to sensitive areas of Adobe Commerce.
Is there a public exploit available for CVE-2025-43585?
As of now, there have been no public exploits reported for CVE-2025-43585, but it remains a critical issue that needs addressing.