Magento Open Source has Business Logic Errors Vulnerability
Impact
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.
Source excerpt · OSVExploitation of this issue does not require user interaction.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 2.4.5-p1 before 2.4.5-p3Ecosystem versions | 2.4.5-p3 |
| From 2.4.4-p1 before 2.4.4-p4Ecosystem versions | 2.4.4-p4 |
Version evidence: OSV · GHSA-28vp-39rf-3q2j
View original version evidence (8 explicit versions)
| Affected range | Recorded fix |
|---|---|
| Earlier releases through 2.0.2 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-28vp-39rf-3q2j
View original version evidence (53 explicit versions)
Original source description
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.