Vulnerability · Published Feb 15, 2024 · Assigned by adobe
CVE-2024-20718[Spain] CSRF to delete Requisition Lists at Adobe Commerce
Medium 4.3
In plain English
A medium-severity cross-site request forgery in Adobe Commerce from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | magento/community-edition | no fix listed | GHSA-hqgj-4396-hmxv |
| Packagist | magento/community-edition | no fix listed | GHSA-hqgj-4396-hmxv |
| Packagist | magento/community-edition | no fix listed | GHSA-hqgj-4396-hmxv |
| Packagist | magento/community-edition | 2.4.6-p4 | GHSA-hqgj-4396-hmxv |
| Packagist | magento/community-edition | 2.4.5-p6 | GHSA-hqgj-4396-hmxv |
| Packagist | magento/community-edition | 2.4.4-p7 | GHSA-hqgj-4396-hmxv |
| Packagist | magento/project-community-edition | no fix listed | GHSA-hqgj-4396-hmxv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Adobe Commerce | 0 – through 2.4.4-p6 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://helpx.adobe.com/security/products/magento/apsb24-03.html vendor-advisory