Vulnerability advisory
CVE-2022-34255
Adobe Commerce Improper Access Control Privilege escalation
Also known as BIT-magento-2022-34255GHSA-x95x-f4g9-mm85
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/devdocs ↗ | |
| 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 through 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 | No fix listed |
Also listed as affected (3)
| |
| GIT github.com/magento/magento2 ↗ | |
| f4c1d7526f05bdfb1327b0701cc345f94aadcaed to before 44a7b6079bcac5ba92040b16f4f74024b4f34d09 | 44a7b6079bcac5ba92040b16f4f74024b4f34d09 |
| 6729b6e01368248abc33300208eb292c95050203 to before 4c36116dcf878e127059d9be9566a119783583f2 | 4c36116dcf878e127059d9be9566a119783583f2 |
| 44a7b6079bcac5ba92040b16f4f74024b4f34d09 through 0f9a056c8d83c4f319626b3e56ec52a533999f25 | No fix listed |
Also listed as affected (8)
| |
Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover for a victim. Exploitation of this issue does not require user interaction.