DemoBook a demo

Vulnerability advisory

CVE-2023-29288

Adobe Commerce | Incorrect Authorization (CWE-863)

Published Updated OSV record ↗

Also known as GHSA-f989-3fp9-q3r2

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/magento/magento2 ↗
44a7b6079bcac5ba92040b16f4f74024b4f34d09 through d846142a3ab8b49597dfb8bd7508d875efdab19aNo fix listed
Also listed as affected (23)
  • 2.3.7-NA
  • 2.3.7-p1
  • 2.3.7-p2
  • 2.3.7-p3
  • 2.3.7-p4
  • 2.4.0-NA
  • 2.4.0-ext\-1
  • 2.4.1-NA
  • 2.4.1-ext\-1
  • 2.4.2-NA
  • 2.4.2-ext\-1
  • 2.4.2-ext\-2
  • 2.4.3-NA
  • 2.4.3-ext\-1
  • 2.4.3-ext\-2
  • 2.4.4-NA
  • 2.4.4-p1
  • 2.4.4-p2
  • 2.4.4-p3
  • 2.4.5-NA
  • 2.4.5-p1
  • 2.4.5-p2
  • 2.4.6-NA

Description

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.