5.3

CVE-2023-29290

Adobe Commerce Guest Cart Shipping Address Overwrite IDOR 

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Commerce Version 2.3.7 Update -
Adobe ≫ Commerce Version 2.3.7 Update p1
Adobe ≫ Commerce Version 2.3.7 Update p2
Adobe ≫ Commerce Version 2.3.7 Update p3
Adobe ≫ Commerce Version 2.3.7 Update p4
Adobe ≫ Commerce Version 2.3.7 Update p4-ext1
Adobe ≫ Commerce Version 2.3.7 Update p4-ext2
Adobe ≫ Commerce Version 2.4.0 Update -
Adobe ≫ Commerce Version 2.4.0 Update ext-1
Adobe ≫ Commerce Version 2.4.0 Update ext-2
Adobe ≫ Commerce Version 2.4.1 Update -
Adobe ≫ Commerce Version 2.4.1 Update ext-1
Adobe ≫ Commerce Version 2.4.1 Update ext-2
Adobe ≫ Commerce Version 2.4.2 Update -
Adobe ≫ Commerce Version 2.4.2 Update ext-1
Adobe ≫ Commerce Version 2.4.2 Update ext-2
Adobe ≫ Commerce Version 2.4.3 Update -
Adobe ≫ Commerce Version 2.4.3 Update ext-1
Adobe ≫ Commerce Version 2.4.3 Update ext-2
Adobe ≫ Commerce Version 2.4.4 Update -
Adobe ≫ Commerce Version 2.4.4 Update p1
Adobe ≫ Commerce Version 2.4.4 Update p2
Adobe ≫ Commerce Version 2.4.4 Update p3
Adobe ≫ Commerce Version 2.4.5 Update -
Adobe ≫ Commerce Version 2.4.5 Update p1
Adobe ≫ Commerce Version 2.4.5 Update p2
Adobe ≫ Commerce Version 2.4.6 Update -
Adobe ≫ Magento Version 2.4.4 Update - SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p1 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p2 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p3 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update - SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p1 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p2 SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update - SwEdition open_source
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.63% 0.467
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Adobe 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-353 Missing Support for Integrity Check

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

https://helpx.adobe.com/security/products/magento/apsb23-35.html
Vendor Advisory