Lucene search

GitHub Advisory DatabaseGHSA-297F-R9W7-W492

HistoryOct 20, 2022 - 7:00 p.m.

Magento Improper input validation vulnerability

2022-10-2019:00:29

CWE-20

CWE-639

CWE-863

GitHub Advisory Database

github.com

magento

input validation

vulnerability

adobe commerce

information exposure

privilege escalation

software

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privilege escalation.

Affected configurations

Vulners

Node

magentocommunity-editionMatch2.4.4

magentocommunity-editionRange2.4.0–2.4.3-p3

magentocommunity-editionRange<2.3.7-p4

VendorProductVersionCPE
magentocommunity-edition2.4.4cpe:2.3:a:magento:community-edition:2.4.4:*:*:*:*:*:*:*
magentocommunity-edition*cpe:2.3:a:magento:community-edition:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
magento	community-edition	2.4.4	cpe:2.3:a:magento:community-edition:2.4.4:::::::*
magento	community-edition	*	cpe:2.3:a:magento:community-edition::::::::

References

github.com/advisories/GHSA-297f-r9w7-w492

helpx.adobe.com/security/products/magento/apsb22-38.html

nvd.nist.gov/vuln/detail/CVE-2022-42344

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

Related for GHSA-297F-R9W7-W492