Cyber Posture

CVE-2025-24409

High

Published: 11 February 2025

Published
11 February 2025
Modified
16 April 2025
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0015 34.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-24409 is an Incorrect Authorization vulnerability (CWE-863) affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. Published on 2025-02-11, it enables a security feature bypass, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to significant confidentiality impact and minor integrity impact.

The vulnerability can be exploited by a remote attacker requiring no privileges or user interaction. Attackers can leverage it over the network with low complexity to bypass security measures, gain unauthorized access, compromise high-impact confidentiality (such as accessing sensitive data), and achieve low-impact integrity modifications.

Adobe's security advisory provides details on mitigation; refer to https://helpx.adobe.com/security/products/magento/apsb25-08.html for patches and recommended actions.

Details

CWE(s)
CWE-863

Affected Products

adobe
commerce
2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8 · ≤ 2.4.4
adobe
commerce b2b
1.3.3, 1.3.4, 1.3.5, 1.4.2, 1.5.0 · ≤ 1.3.3
adobe
magento
2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8 · ≤ 2.4.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Incorrect authorization vulnerability in public-facing Adobe Commerce app enables remote unauthorized access without privileges, directly mapping to exploitation of public-facing applications for initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References