Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.9 | CVE-2025-54265 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the affected Adobe Commerce versions. Since the vulnerability allows for unauthorized read access, the attacker can retrieve sensitive information without needing any user interaction or elevated privileges.
Affected Products
- Adobe Commerce 2.4.9-alpha2: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p2: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.7-p7: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.6-p12: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.5-p14: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.4-p15: Affected by Incorrect Authorization vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Commerce that addresses the Incorrect Authorization issue. Regularly applying security patches and updates is essential to protect against such vulnerabilities.