p PatchFirst

CVE-2024-39398

CVE-2024-39398 · OTP 2FA can be bruteforced

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.

CVSS 7.4 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • adobe commerce

    Versions
    • ≥ 0, ≤ 2.4.4-p9: Affected (semver)

    No fix published

  • magento/project-community-edition Packagist

    Versions
    • 0.1.0-alpha100
    • 0.1.0-alpha101
    • 0.1.0-alpha102
    • 0.1.0-alpha103
    • 0.1.0-alpha104
    • 0.1.0-alpha105
    • 0.1.0-alpha106
    • 0.1.0-alpha107
    • 0.1.0-alpha108
    • 0.1.0-alpha89
    • 0.1.0-alpha90
    • 0.1.0-alpha91
    • 0.1.0-alpha92
    • 0.1.0-alpha93
    • 0.1.0-alpha94
    • 0.1.0-alpha95
    • 0.1.0-alpha96
    • 0.1.0-alpha97
    • 0.1.0-alpha98
    • 0.1.0-alpha99
    • 0.42.0-beta1
    • 0.42.0-beta10
    • 0.42.0-beta11
    • 0.42.0-beta2
    • 0.42.0-beta3
    • 0.42.0-beta4
    • 0.42.0-beta5
    • 0.42.0-beta6
    • 0.42.0-beta7
    • 0.42.0-beta8
    • 0.42.0-beta9
    • 0.74.0-beta1
    • 0.74.0-beta10
    • 0.74.0-beta11
    • 0.74.0-beta12
    • 0.74.0-beta13
    • 0.74.0-beta14
    • 0.74.0-beta15
    • 0.74.0-beta16
    • 0.74.0-beta2
    • 0.74.0-beta3
    • 0.74.0-beta4
    • 0.74.0-beta5
    • 0.74.0-beta6
    • 0.74.0-beta7
    • 0.74.0-beta8
    • 0.74.0-beta9
    • 1.0.0-beta
    • 2.0.0
    • 2.0.0-rc
    • 2.0.0-rc2
    • 2.0.1
    • 2.0.2
    Affected ranges
    • ECOSYSTEM: ≤ 2.0.2

    No fix published

  • magento/community-edition Packagist

    Versions
    • 2.4.7
    • 2.4.7-beta1
    • 2.4.7-beta2
    • 2.4.7-beta3
    • 2.4.7-p1
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.7-beta1, < 2.4.7-p2

    Update to 2.4.7-p2

  • magento/community-edition Packagist

    Versions
    • 2.4.6-p1
    • 2.4.6-p2
    • 2.4.6-p3
    • 2.4.6-p4
    • 2.4.6-p5
    • 2.4.6-p6
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.6-p1, < 2.4.6-p7

    Update to 2.4.6-p7

  • magento/community-edition Packagist

    Versions
    • 2.4.5-p1
    • 2.4.5-p2
    • 2.4.5-p3
    • 2.4.5-p4
    • 2.4.5-p5
    • 2.4.5-p6
    • 2.4.5-p7
    • 2.4.5-p8
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.5-p1, < 2.4.5-p9

    Update to 2.4.5-p9

  • magento/community-edition Packagist

    Versions
    • 2.4.4-p1
    • 2.4.4-p2
    • 2.4.4-p3
    • 2.4.4-p4
    • 2.4.4-p5
    • 2.4.4-p6
    • 2.4.4-p7
    • 2.4.4-p8
    • 2.4.4-p9
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.4-p1, < 2.4.4-p10

    Update to 2.4.4-p10

  • magento/community-edition Packagist

    Versions
    • 2.4.7

    No fix published

  • magento/community-edition Packagist

    Versions
    • 2.4.6

    No fix published

  • magento/community-edition Packagist

    Versions
    • 2.4.5

    No fix published

  • magento/community-edition Packagist

    Versions
    • 2.4.4

    No fix published

Original sources

Check your server →