Magento Improper Access Control vulnerability
Impact
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.
Source excerpt · OSVExploitation of this issue does not require user interaction.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 2.3.0 before 2.3.7-p4Ecosystem versions | 2.3.7-p4 |
| From 2.4.4 before 2.4.5Ecosystem versions | 2.4.5 |
| From 2.4.0 before 2.4.3-p3Ecosystem versions | 2.4.3-p3 |
Version evidence: OSV · GHSA-9wjf-94h3-r4rh
View original version evidence (41 explicit versions)
Original source description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2022-34259
- Patch github.com/magento/magento2/commit/246d524b7586af2245092008e0d92b8d6fdd8523
- Patch github.com/magento/magento2/commit/5548bc64b5bc904346c0af9193a7fbb5274b4efa
- Patch github.com/magento/magento2/commit/5f07eba878296a37bd5c3a2baecad48948547594
- Source reference github.com/magento/magento2
- Security advisory helpx.adobe.com/security/products/magento/apsb22-38.html