GHSA-r7mm-grf3-5fjv
Magento Improper Authorization vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2022-34256
- Aliases
- BIT-magento-2022-34256
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.7-p4 |
| Packagist · magento/community-edition | introduced 2.4.4, fixed 2.4.5 |
| Packagist · magento/community-edition | introduced 2.4.0, fixed 2.4.3-p3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-34256 ADVISORY
- https://github.com/magento/magento2/commit/246d524b7586af2245092008e0d92b8d6fdd8523 WEB
- https://github.com/magento/magento2/commit/5548bc64b5bc904346c0af9193a7fbb5274b4efa WEB
- https://github.com/magento/magento2/commit/5f07eba878296a37bd5c3a2baecad48948547594 WEB
- https://github.com/magento/magento2 PACKAGE
- https://helpx.adobe.com/security/products/magento/apsb22-38.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |