Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to elevated privileges. This increases the integrity impact to high and does not require user interaction for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-54267 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can send specially crafted requests to the affected Adobe Commerce application. By bypassing the security measures in place, the attacker can gain unauthorized access to elevated privileges, allowing them to perform actions that should be restricted. This can be done remotely without any need for user interaction.
Affected Products
- Adobe Commerce 2.4.9-alpha2: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.8-p2: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.7-p7: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.6-p12: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.5-p14: Affected by Incorrect Authorization vulnerability.
- Adobe Commerce 2.4.4-p15: Affected by Incorrect Authorization vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Adobe Commerce that addresses this issue. Regularly applying security patches and updates can help protect against such vulnerabilities. Additionally, implementing strict access controls and monitoring for unusual activity can further enhance security.