Description
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories via PHP filter chain and also can have a low-availability impact on the service. Exploitation of this issue does not require user interaction and scope is changed.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
https://helpx.adobe.com/security/products/magento/apsb24-73.html
Scores
CVSS v3
7.6
EPSS
0.0026
EPSS Percentile
49.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-20
Status
published
Products (8)
adobe/commerce
adobe/commerce
2.3.7 (9 CPE variants)
adobe/commerce
2.4.0 (6 CPE variants)
adobe/commerce
2.4.1 (6 CPE variants)
adobe/commerce
2.4.2 (8 CPE variants)
adobe/commerce
2.4.3 (8 CPE variants)
adobe/commerce
2.4.4 (11 CPE variants)
adobe/commerce
2.4.5
Published
Oct 10, 2024
Tracked Since
Feb 18, 2026