Vulnerability advisory
CVE-2022-34256
Adobe Commerce Improper Authorization Privilege escalation
Also known as BIT-magento-2022-34256GHSA-r7mm-grf3-5fjv
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/devdocs ↗ | |
| 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 through 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 | No fix listed |
Also listed as affected (3)
| |
| GIT github.com/magento/magento2 ↗ | |
| f4c1d7526f05bdfb1327b0701cc345f94aadcaed to before 44a7b6079bcac5ba92040b16f4f74024b4f34d09 | 44a7b6079bcac5ba92040b16f4f74024b4f34d09 |
| 6729b6e01368248abc33300208eb292c95050203 to before 4c36116dcf878e127059d9be9566a119783583f2 | 4c36116dcf878e127059d9be9566a119783583f2 |
| 44a7b6079bcac5ba92040b16f4f74024b4f34d09 through 0f9a056c8d83c4f319626b3e56ec52a533999f25 | No fix listed |
Also listed as affected (8)
| |
Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.