CVE-2025-27192

{"id": "CVE-2025-27192", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2025-04-08T21:15:51.040", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb25-26.html", "source": "psirt@adobe.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does not require user interaction."}, {"lang": "es", "value": "Las versiones 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de Credenciales Insuficientemente Protegidas que podr\u00eda provocar la omisi\u00f3n de una funci\u00f3n de seguridad. Un atacante con privilegios elevados podr\u00eda explotar esta vulnerabilidad para obtener acceso no autorizado a recursos protegidos mediante la obtenci\u00f3n de informaci\u00f3n confidencial de credenciales. Para explotar este problema, no se requiere la interacci\u00f3n del usuario."}], "lastModified": "2025-04-09T20:02:41.860", "sourceIdentifier": "psirt@adobe.com"}