Cyber Posture

CVE-2025-24434

Critical

Published: 11 February 2025

Published
11 February 2025
Modified
16 April 2025
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0022 43.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-24434 is an Incorrect Authorization vulnerability (CWE-863) affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. Published on 2025-02-11, this flaw enables privilege escalation by allowing attackers to bypass security measures and gain unauthorized access.

With a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the vulnerability is exploitable remotely by unauthenticated attackers without requiring user interaction. Successful exploitation can lead to session takeover, resulting in high confidentiality and integrity impacts.

Adobe's security bulletin APSB25-08, available at https://helpx.adobe.com/security/products/magento/apsb25-08.html, provides guidance on mitigation and patches for affected versions.

Details

CWE(s)
CWE-863

Affected Products

adobe
commerce
2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8
adobe
commerce b2b
1.3.3, 1.3.4, 1.3.5, 1.4.2, 1.5.0
adobe
magento
2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Incorrect authorization vulnerability in public-facing Adobe Commerce web app enables remote unauthenticated exploitation for initial access (T1190) and privilege escalation via bypass (T1068), leading to session takeover.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References