Vulnerability advisory

GHSA-9wjf-94h3-r4rh

Magento Improper Access Control vulnerability

Published Aug 17, 2022Updated Sep 10, 2026OSV record ↗

Also known as BIT-magento-2022-34259CVE-2022-34259

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.3.0` to before 2.3.7-p4	`2.3.7-p4`Advisories →
Also listed as affected (17) `2.3.0` `2.3.1` `2.3.2` `2.3.2-p2` `2.3.3` `2.3.3-p1` `2.3.4` `2.3.4-p2` `2.3.5` `2.3.5-p1` `2.3.5-p2` `2.3.6` `2.3.6-p1` `2.3.7` `2.3.7-p1` `2.3.7-p2` `2.3.7-p3`
`2.4.4` to before 2.4.5	`2.4.5`Advisories →
Also listed as affected (14) `2.4.4` `2.4.4-p1` `2.4.4-p10` `2.4.4-p11` `2.4.4-p12` `2.4.4-p13` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9`
`2.4.0` to before 2.4.3-p3	`2.4.3-p3`Advisories →
Also listed as affected (10) `2.4.0` `2.4.0-p1` `2.4.1` `2.4.1-p1` `2.4.2` `2.4.2-p1` `2.4.2-p2` `2.4.3` `2.4.3-p1` `2.4.3-p2`

Description

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

GHSA-9wjf-94h3-r4rh

Affected versions

magento/community-edition Packagist

Description

References