Magento Improper Authorization vulnerability

中 4.3CVE-2024-39413 · GHSA-8w5f-8992-g86j · 14/08/2024 公開 · 17/06/2026 更新

要点

CVE-2024-39413 は magento/community-edition, magento/project-community-edition, commerce (adobe) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.44%（全脆弱性の 38.4% より高い）。
対処：2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
magento/community-edition Packagist	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7≥ 2.4.4-p1, < 2.4.4-p10≥ 2.4.5-p1, < 2.4.5-p9≥ 2.4.6-p1, < 2.4.6-p7≥ 2.4.7-beta1, < 2.4.7-p2`	`2.4.4-p102.4.5-p92.4.6-p72.4.7-p2`
magento/project-community-edition Packagist	`≤ 2.0.2`	修正版なし
commerce adobe	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7≤ 2.4.3`	修正版なし
magento adobe	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7≤ 2.4.3`	修正版なし

概要

Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

NVD の説明

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.