4.3

CVE-2023-29296

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

Data is provided by the National Vulnerability Database (NVD)
Adobe ≫ Commerce Version2.3.7 Update-
Adobe ≫ Commerce Version2.3.7 Updatep1
Adobe ≫ Commerce Version2.3.7 Updatep2
Adobe ≫ Commerce Version2.3.7 Updatep3
Adobe ≫ Commerce Version2.3.7 Updatep4
Adobe ≫ Commerce Version2.3.7 Updatep4-ext1
Adobe ≫ Commerce Version2.3.7 Updatep4-ext2
Adobe ≫ Commerce Version2.4.0 Update-
Adobe ≫ Commerce Version2.4.0 Updateext-1
Adobe ≫ Commerce Version2.4.0 Updateext-2
Adobe ≫ Commerce Version2.4.1 Update-
Adobe ≫ Commerce Version2.4.1 Updateext-1
Adobe ≫ Commerce Version2.4.1 Updateext-2
Adobe ≫ Commerce Version2.4.2 Update-
Adobe ≫ Commerce Version2.4.2 Updateext-1
Adobe ≫ Commerce Version2.4.2 Updateext-2
Adobe ≫ Commerce Version2.4.3 Update-
Adobe ≫ Commerce Version2.4.3 Updateext-1
Adobe ≫ Commerce Version2.4.3 Updateext-2
Adobe ≫ Commerce Version2.4.4 Update-
Adobe ≫ Commerce Version2.4.4 Updatep1
Adobe ≫ Commerce Version2.4.4 Updatep2
Adobe ≫ Commerce Version2.4.4 Updatep3
Adobe ≫ Commerce Version2.4.5 Update-
Adobe ≫ Commerce Version2.4.5 Updatep1
Adobe ≫ Commerce Version2.4.5 Updatep2
Adobe ≫ Commerce Version2.4.6 Update-
Adobe ≫ Magento Version2.4.4 Update- SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep1 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep2 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep3 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Update- SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep1 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep2 SwEditionopen_source
Adobe ≫ Magento Version2.4.6 Update- SwEditionopen_source
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.295
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@adobe.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.