CVE-2024-39409 MEDIUM

CVE-2024-39409: Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

Vendor Adobe
Product Adobe Commerce
Weakness CWE-352 · CSRF
Published August 14, 2024
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.

Key dates

02Disclosure timeline

August 14, 2024 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-32266 WordPress 404 Image Redirection (Replace Broken Images) plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability CVE-2022-4604 wp-english-wp-admin Plugin english-wp-admin.php register_endpoints cross-site request forgery CVE-2022-20787 Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability CVE-2021-3976 Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2 CVE-2025-58922 WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerability