VulnerabilityAnalyzed

CVE-2024-49521

Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass.

HIGH 7.7EPSS 0.75%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.75%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction.

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.75% probability · 53th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: adobe/commerce · adobe/magento
Source: psirt@adobe.com

References

https://helpx.adobe.com/security/products/magento/apsb24-90.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.