CVE-2025-24411
Published: 11 February 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-24411 is an Improper Access Control vulnerability (CWE-284) in Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. This flaw enables a security feature bypass, allowing unauthorized access that impacts confidentiality and integrity. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and was published on 2025-02-11.
A low-privileged attacker with network access can exploit this issue without requiring user interaction. Successful exploitation allows the attacker to bypass security measures, resulting in unauthorized access with high impacts to confidentiality and integrity, but no availability disruption.
Adobe's security bulletin APSB25-08 provides details on mitigation, available at https://helpx.adobe.com/security/products/magento/apsb25-08.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The improper access control vulnerability in the public-facing Adobe Commerce web application allows low-privileged authenticated attackers to bypass security features for unauthorized access (high confidentiality/integrity impact), directly enabling exploitation of public-facing applications (T1190) and exploitation for privilege escalation (T1068).