6.5

CVE-2025-24424

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Commerce B2b Version < 1.3.3
Adobe ≫ Commerce B2b Version 1.3.3 Update -
Adobe ≫ Commerce B2b Version 1.3.3 Update p10
Adobe ≫ Commerce B2b Version 1.3.3 Update p11
Adobe ≫ Commerce B2b Version 1.3.4 Update -
Adobe ≫ Commerce B2b Version 1.3.4 Update p10
Adobe ≫ Commerce B2b Version 1.3.4 Update p9
Adobe ≫ Commerce B2b Version 1.3.5 Update -
Adobe ≫ Commerce B2b Version 1.3.5 Update p7
Adobe ≫ Commerce B2b Version 1.3.5 Update p8
Adobe ≫ Commerce B2b Version 1.4.2 Update -
Adobe ≫ Commerce B2b Version 1.4.2 Update p1
Adobe ≫ Commerce B2b Version 1.4.2 Update p2
Adobe ≫ Commerce B2b Version 1.4.2 Update p3
Adobe ≫ Commerce B2b Version 1.5.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.75% 0.519
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Adobe 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://helpx.adobe.com/security/products/magento/apsb25-08.html
Vendor Advisory