Vulnerability advisory

CVE-2024-34104

Adobe Commerce | Improper Authorization (CWE-285)

Published Jun 13, 2024Updated Oct 28, 2026OSV record ↗

Also known as BIT-magento-2024-34104GHSA-wwj3-573j-rvvm

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
44a7b6079bcac5ba92040b16f4f74024b4f34d09 through d10435b11ada4e502dca7539f8fd31d059d3c482	No fix listed
Also listed as affected (40) `2.3.7-NA` `2.3.7-p1` `2.3.7-p2` `2.3.7-p3` `2.3.7-p4` `2.4.0-NA` `2.4.0-ext\-1` `2.4.1-NA` `2.4.1-ext\-1` `2.4.2-NA` `2.4.2-ext\-1` `2.4.2-ext\-2` `2.4.3-NA` `2.4.3-ext\-1` `2.4.3-ext\-2` `2.4.3-ext\-3` `2.4.4-NA` `2.4.4-p1` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.5-NA` `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.6-NA` `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.7-b1`

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

CVE-2024-34104

Affected versions

Repository

Description

References