p PatchFirst

CVE-2022-34259

CVE-2022-34259 · Adobe Commerce Improper Access Control Security feature bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

CVSS 5.3 · Medium · EPSS 1.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • magento commerce

    Versions
    • ≥ unspecified, ≤ 2.4.4: Affected (custom)
    • ≥ unspecified, ≤ 2.3.7-p3: Affected (custom)
    • ≥ unspecified, ≤ 2.4.3-p2: Affected (custom)
    • ≥ unspecified, ≤ None: Affected (custom)

    No fix published

  • magento/community-edition Packagist

    Versions
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.2-p2
    • 2.3.3
    • 2.3.3-p1
    • 2.3.4
    • 2.3.4-p2
    • 2.3.5
    • 2.3.5-p1
    • 2.3.5-p2
    • 2.3.6
    • 2.3.6-p1
    • 2.3.7
    • 2.3.7-p1
    • 2.3.7-p2
    • 2.3.7-p3
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.7-p4

    Update to 2.3.7-p4

  • magento/community-edition Packagist

    Versions
    • 2.4.4
    • 2.4.4-p1
    • 2.4.4-p10
    • 2.4.4-p11
    • 2.4.4-p12
    • 2.4.4-p13
    • 2.4.4-p2
    • 2.4.4-p3
    • 2.4.4-p4
    • 2.4.4-p5
    • 2.4.4-p6
    • 2.4.4-p7
    • 2.4.4-p8
    • 2.4.4-p9
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.4, < 2.4.5

    Update to 2.4.5

  • magento/community-edition Packagist

    Versions
    • 2.4.0
    • 2.4.0-p1
    • 2.4.1
    • 2.4.1-p1
    • 2.4.2
    • 2.4.2-p1
    • 2.4.2-p2
    • 2.4.3
    • 2.4.3-p1
    • 2.4.3-p2
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0, < 2.4.3-p3

    Update to 2.4.3-p3

Original sources

Check your server →