Vulnerability advisory

CVE-2024-34106

Insecure Direct Object Reference - An attacker can able to erase the victim quote details

Published Jun 13, 2024Updated Oct 28, 2026OSV record ↗

Also known as BIT-magento-2024-34106GHSA-p6h9-gx5g-wg64

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
44a7b6079bcac5ba92040b16f4f74024b4f34d09 through d10435b11ada4e502dca7539f8fd31d059d3c482	No fix listed
Also listed as affected (40) `2.3.7-NA` `2.3.7-p1` `2.3.7-p2` `2.3.7-p3` `2.3.7-p4` `2.4.0-NA` `2.4.0-ext\-1` `2.4.1-NA` `2.4.1-ext\-1` `2.4.2-NA` `2.4.2-ext\-1` `2.4.2-ext\-2` `2.4.3-NA` `2.4.3-ext\-1` `2.4.3-ext\-2` `2.4.3-ext\-3` `2.4.4-NA` `2.4.4-p1` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.5-NA` `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.6-NA` `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.7-b1`

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

CVE-2024-34106

Affected versions

Repository

Description

References