CVE-2024-45119
Severity CVSS v4.0:
Pending analysis
Type:
CWE-918
Server-Side Request Forgery (SSRF)
Publication date:
10/10/2024
Last modified:
12/12/2024
Description
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
Impact
Base Score 3.x
4.90
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:* | ||
cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page