CVE-2024-39409

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb24-61.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:commerce::::::::
	cpe:2.3:a:adobe:commerce:2.4.4:-::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p6::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p7::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p8::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p9::::::
	cpe:2.3:a:adobe:commerce:2.4.5:-::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p6::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p7::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p8::::::
	cpe:2.3:a:adobe:commerce:2.4.6:-::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p6::::::
	cpe:2.3:a:adobe:commerce:2.4.7:-::::::
	cpe:2.3:a:adobe:commerce:2.4.7:b1::::::
	cpe:2.3:a:adobe:commerce:2.4.7:b2::::::
	cpe:2.3:a:adobe:commerce:2.4.7:p1::::::

Configuration 2 (hide)

OR	cpe:2.3:a:adobe:magento:::::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:-:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p1:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p2:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p3:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p4:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p5:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p6:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p7:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p8:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.4:p9:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:-:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p1:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p2:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p3:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p4:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p5:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p6:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p7:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.5:p8:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.6:-:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.6:p1:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.6:p2:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.6:p3:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.6:p4:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.6:p5:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.6:p6:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.7:-:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.7:b1:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.7:b2:::open_source:::*
	cpe:2.3:a:adobe:magento:2.4.7:p1:::open_source:::*

History

16 Oct 2024, 13:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.3~~	v2 : unknown v3 : 4.3

16 Sep 2024, 13:15

Type	Values Removed	Values Added
Summary		(es) Las versiones 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de Cross-Site Request Forgery (CSRF) que podría permitir a un atacante omitir las funciones de seguridad. y realizar acciones menores no autorizadas en nombre de un usuario. La vulnerabilidad podría explotarse engañando a la víctima para que haga clic en un enlace o cargue una página que envíe una solicitud maliciosa. La explotación de este problema requiere la interacción del usuario.
Summary	(en) Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.	(en) Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.

14 Aug 2024, 14:42

Type	Values Removed	Values Added
First Time		Adobe commerce Adobe magento Adobe
CVSS	v2 : ~~unknown~~ v3 : ~~4.3~~	v2 : unknown v3 : 6.3
References	~~() https://helpx.adobe.com/security/products/magento/apsb24-61.html -~~	() https://helpx.adobe.com/security/products/magento/apsb24-61.html - Vendor Advisory
CPE		cpe:2.3:a:adobe:magento:2.4.6:p1:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.6:p2:::::: cpe:2.3:a:adobe:magento:2.4.5:p4:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.5:p8:::::: cpe:2.3:a:adobe:magento:2.4.5:p2:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.6:-:::::: cpe:2.3:a:adobe:magento:2.4.5:p1:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.4:p6:::::: cpe:2.3:a:adobe:commerce:::::::: cpe:2.3:a:adobe:commerce:2.4.5:p2:::::: cpe:2.3:a:adobe:magento:::::open_source:::* cpe:2.3:a:adobe:commerce:2.4.4:p8:::::: cpe:2.3:a:adobe:magento:2.4.4:p8:::open_source:::* cpe:2.3:a:adobe:magento:2.4.6:p2:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.7:-:::::: cpe:2.3:a:adobe:commerce:2.4.5:p7:::::: cpe:2.3:a:adobe:commerce:2.4.4:p9:::::: cpe:2.3:a:adobe:commerce:2.4.6:p6:::::: cpe:2.3:a:adobe:magento:2.4.5:p6:::open_source:::* cpe:2.3:a:adobe:magento:2.4.5:p7:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.5:p1:::::: cpe:2.3:a:adobe:magento:2.4.6:p6:::open_source:::* cpe:2.3:a:adobe:magento:2.4.7:p1:::open_source:::* cpe:2.3:a:adobe:magento:2.4.4:p2:::open_source:::* cpe:2.3:a:adobe:magento:2.4.4:p9:::open_source:::* cpe:2.3:a:adobe:magento:2.4.5:-:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.6:p5:::::: cpe:2.3:a:adobe:magento:2.4.7:b1:::open_source:::* cpe:2.3:a:adobe:magento:2.4.7:b2:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.4:p5:::::: cpe:2.3:a:adobe:magento:2.4.4:p4:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.4:p1:::::: cpe:2.3:a:adobe:commerce:2.4.5:p4:::::: cpe:2.3:a:adobe:commerce:2.4.5:p5:::::: cpe:2.3:a:adobe:magento:2.4.6:p5:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.7:b2:::::: cpe:2.3:a:adobe:magento:2.4.6:p4:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.4:p4:::::: cpe:2.3:a:adobe:commerce:2.4.6:p1:::::: cpe:2.3:a:adobe:magento:2.4.4:p1:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.5:-:::::: cpe:2.3:a:adobe:magento:2.4.4:-:::open_source:::* cpe:2.3:a:adobe:magento:2.4.4:p3:::open_source:::* cpe:2.3:a:adobe:magento:2.4.4:p5:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.7:p1:::::: cpe:2.3:a:adobe:magento:2.4.7:-:::open_source:::* cpe:2.3:a:adobe:magento:2.4.6:p3:::open_source:::* cpe:2.3:a:adobe:magento:2.4.4:p6:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.5:p3:::::: cpe:2.3:a:adobe:commerce:2.4.4:-:::::: cpe:2.3:a:adobe:magento:2.4.4:p7:::open_source:::* cpe:2.3:a:adobe:magento:2.4.6:-:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.4:p3:::::: cpe:2.3:a:adobe:magento:2.4.5:p8:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.7:b1:::::: cpe:2.3:a:adobe:magento:2.4.5:p3:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.4:p2:::::: cpe:2.3:a:adobe:commerce:2.4.6:p4:::::: cpe:2.3:a:adobe:commerce:2.4.5:p6:::::: cpe:2.3:a:adobe:commerce:2.4.4:p7:::::: cpe:2.3:a:adobe:magento:2.4.5:p5:::open_source:::* cpe:2.3:a:adobe:commerce:2.4.6:p3::::::

14 Aug 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-14 12:15

Updated : 2024-10-16 13:35

NVD link : CVE-2024-39409

Mitre link : CVE-2024-39409

CVE.ORG link : CVE-2024-39409

JSON object : View

Products Affected

adobe

commerce
magento

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

4.3 /10