Vulnerability advisory
CVE-2022-35692
Adobe Commerce Improper Access Control Security feature bypass
Also known as GHSA-gm4m-9rm8-7rxj
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/magento2 ↗ | |
| 6729b6e01368248abc33300208eb292c95050203 to before 0f9a056c8d83c4f319626b3e56ec52a533999f25 | 0f9a056c8d83c4f319626b3e56ec52a533999f25 |
Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account detials. Exploitation of this issue does not require user interaction.