8.8

CVE-2022-42344

[CVE-2021-36032] Magento IDOR Leads to Account Takeover

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Commerce Version < 2.3.7
Adobe ≫ Commerce Version >= 2.4.0 < 2.4.3
Adobe ≫ Commerce Version 2.3.7 Update -
Adobe ≫ Commerce Version 2.3.7 Update p1
Adobe ≫ Commerce Version 2.3.7 Update p2
Adobe ≫ Commerce Version 2.3.7 Update p3
Adobe ≫ Commerce Version 2.4.3 Update -
Adobe ≫ Commerce Version 2.4.3 Update p1
Adobe ≫ Commerce Version 2.4.3 Update p2
Adobe ≫ Commerce Version 2.4.4 Update -
Magento ≫ Magento SwEdition open_source Version < 2.3.7
Magento ≫ Magento SwEdition open_source Version >= 2.4.0 < 2.4.3
Magento ≫ Magento Version 2.3.7 Update - SwEdition open_source
Magento ≫ Magento Version 2.3.7 Update p1 SwEdition open_source
Magento ≫ Magento Version 2.3.7 Update p2 SwEdition open_source
Magento ≫ Magento Version 2.3.7 Update p3 SwEdition open_source
Magento ≫ Magento Version 2.4.3 Update - SwEdition open_source
Magento ≫ Magento Version 2.4.3 Update p1 SwEdition open_source
Magento ≫ Magento Version 2.4.3 Update p2 SwEdition open_source
Magento ≫ Magento Version 2.4.4 Update - SwEdition open_source
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.16% 0.648
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Adobe 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://helpx.adobe.com/security/products/magento/apsb22-38.html
Vendor Advisory