GHSA-6ff8-jrfg-43hh

Magento Business Logic Error vulnerability

En bref

Publiée
Mise à jour
CVE
CVE-2025-24425
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue does not require user interaction.

Paquets affectés

PaquetVersions
Packagist · magento/community-editionintroduced 2.4.7-beta1, fixed 2.4.7-p4
Packagist · magento/community-editionintroduced 2.4.6-p1, fixed 2.4.6-p9
Packagist · magento/community-editionintroduced 2.4.5-p1, fixed 2.4.5-p11
Packagist · magento/community-editionintroduced 0, fixed 2.4.4-p12
Packagist · magento/community-edition2.4.7
Packagist · magento/community-edition2.4.6
Packagist · magento/community-edition2.4.5
Packagist · magento/community-edition2.4.4
Packagist · magento/community-edition2.4.8-beta1
Packagist · magento/project-community-editionintroduced 0, last affected 2.0.2

Références

Sources

SourceLicence
OSV.devCC-BY 4.0 — GitHub Advisory Database