Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 3.1 | CVE-2026-21295 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious link that redirects users to an untrusted site. The attacker then needs to convince users to click on this link, which will lead them to the malicious website. Since user interaction is required, social engineering techniques may be employed to increase the likelihood of users clicking the link.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by URL Redirection vulnerability.
- Adobe Commerce 2.4.8-p3: Affected by URL Redirection vulnerability.
- Adobe Commerce 2.4.7-p8: Affected by URL Redirection vulnerability.
- Adobe Commerce 2.4.6-p13: Affected by URL Redirection vulnerability.
- Adobe Commerce 2.4.5-p15: Affected by URL Redirection vulnerability.
- Adobe Commerce 2.4.4-p16: Affected by URL Redirection vulnerability.
Mitigation
To mitigate this vulnerability, users should be cautious about clicking on links from untrusted sources. It is also recommended to update to the latest version of Adobe Commerce where this vulnerability has been addressed. Implementing security measures such as web application firewalls can help detect and block malicious redirects.