CVE-2025-24407
Published: 11 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-24407 is an Incorrect Authorization vulnerability (CWE-863) affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. Published on 2025-02-11, it enables a security feature bypass, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact and low integrity impact.
A low-privileged attacker with network access can exploit this vulnerability without user interaction. Successful exploitation allows the attacker to perform actions beyond their granted permissions, potentially accessing sensitive data (high confidentiality impact) and making limited unauthorized modifications (low integrity impact).
Adobe's security advisory APSB25-08, available at https://helpx.adobe.com/security/products/magento/apsb25-08.html, provides details on mitigation, including recommended patches for affected versions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Incorrect authorization (CWE-863) in public-facing Adobe Commerce allows low-privileged network attackers to bypass permissions for unauthorized data access and limited modifications, directly enabling exploitation of public-facing applications (T1190) and privilege escalation via software vulnerability (T1068).