Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-54236 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted requests to the affected Adobe Commerce versions. Since the vulnerability allows for improper input validation, the attacker can bypass security features and take over user sessions without needing any user interaction, making it a critical risk for affected systems.
Affected Products
- Adobe Commerce 2.4.9-alpha2
- Adobe Commerce 2.4.8-p2
- Adobe Commerce 2.4.7-p7
- Adobe Commerce 2.4.6-p12
- Adobe Commerce 2.4.5-p14
- Adobe Commerce 2.4.4-p15
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Commerce that addresses the improper input validation issue. Regularly applying security patches and updates is essential to protect against potential exploits.