CVE-2025-24419

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to modify select data. Exploitation of this issue does not require user interaction.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb25-08.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:commerce_b2b::::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.3:-::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.4:-::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.5:-::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.5:p7::::::
	cpe:2.3:a:adobe:commerce_b2b:1.3.5:p8::::::
	cpe:2.3:a:adobe:commerce_b2b:1.4.2:-::::::
	cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1::::::
	cpe:2.3:a:adobe:commerce_b2b:1.4.2:p2::::::
	cpe:2.3:a:adobe:commerce_b2b:1.4.2:p3::::::
	cpe:2.3:a:adobe:commerce_b2b:1.5.0:::::::*

History

15 Apr 2025, 17:15

Type	Values Removed	Values Added
CPE		cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1:::::: cpe:2.3:a:adobe:commerce_b2b:::::::: cpe:2.3:a:adobe:commerce_b2b:1.3.5:-:::::: cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10:::::: cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11:::::: cpe:2.3:a:adobe:commerce_b2b:1.3.5:p8:::::: cpe:2.3:a:adobe:commerce_b2b:1.3.3:-:::::: cpe:2.3:a:adobe:commerce_b2b:1.4.2:-:::::: cpe:2.3:a:adobe:commerce_b2b:1.5.0:::::::* cpe:2.3:a:adobe:commerce_b2b:1.3.4:-:::::: cpe:2.3:a:adobe:commerce_b2b:1.3.5:p7:::::: cpe:2.3:a:adobe:commerce_b2b:1.4.2:p3:::::: cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10:::::: cpe:2.3:a:adobe:commerce_b2b:1.4.2:p2:::::: cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9::::::
First Time		Adobe commerce B2b Adobe
Summary	(en) Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted. Exploitation of this issue does not require user interaction.	(en) Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to modify select data. Exploitation of this issue does not require user interaction.
References	~~() https://helpx.adobe.com/security/products/magento/apsb25-08.html -~~	() https://helpx.adobe.com/security/products/magento/apsb25-08.html - Vendor Advisory

27 Feb 2025, 21:15

Type	Values Removed	Values Added
Summary		(es) Las versiones 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de autorización incorrecta que podría provocar la omisión de una función de seguridad. Un atacante con pocos privilegios podría aprovechar esta vulnerabilidad para realizar acciones con permisos que no se le han concedido. La explotación de este problema no requiere la interacción del usuario.
Summary	(en) Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted. Exploitation of this issue does not require user interaction.	(en) Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted. Exploitation of this issue does not require user interaction.

11 Feb 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-11 18:15

Updated : 2025-04-16 17:17

NVD link : CVE-2025-24419

Mitre link : CVE-2025-24419

CVE.ORG link : CVE-2025-24419

JSON object : View

Products Affected

adobe

commerce_b2b

CWE

CWE-863

Incorrect Authorization

4.3 /10