Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or interact with a compromised web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.4 | CVE-2026-34647 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL that the victim is tricked into visiting. Once the victim interacts with the compromised web page or URL, the attacker can leverage the SSRF vulnerability to bypass security measures and gain unauthorized access to sensitive information.
Affected Products
- Adobe Commerce 2.4.9-beta1: Affected by SSRF vulnerability allowing unauthorized access.
- Adobe Commerce 2.4.8-p4: Vulnerable to security feature bypass through SSRF.
- Adobe Commerce 2.4.7-p9: Exposed to SSRF leading to potential data breaches.
- Adobe Commerce 2.4.6-p14: Susceptible to SSRF attacks enabling unauthorized read access.
- Adobe Commerce 2.4.5-p16: Vulnerability allows attackers to bypass security measures.
- Adobe Commerce 2.4.4-p17: Affected by SSRF, risking unauthorized access to sensitive data.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the SSRF issue. Additionally, implementing strict input validation and monitoring for unusual web traffic can help reduce the risk of exploitation.