Vulnerability advisory
CVE-2024-20718
[Spain] CSRF to delete Requisition Lists at Adobe Commerce
Also known as GHSA-hqgj-4396-hmxv
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/magento2 ↗ | |
| 0f9a056c8d83c4f319626b3e56ec52a533999f25 through 6cc0d28cf66074adebc261e981eb35811601f813 | No fix listed |
Also listed as affected (17)
| |
Description
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.