CVE-2024-39413 MEDIUM

CVE-2024-39413: An unauthorized user can export the Invoiced Sales Report

Vendor Adobe
Product Adobe Commerce
Weakness CWE-285
Published August 14, 2024
Last update August 14, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

Key dates

02Disclosure timeline

August 14, 2024 CVE published
August 14, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-43983 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions CVE-2021-24195 Login as User or Customer (User Switching) < 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User CVE-2023-21549 Windows SMB Witness Service Elevation of Privilege Vulnerability CVE-2024-0870 YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update CVE-2026-2693 CoCoTeaNet CyreneAdmin System Info Endpoint getCount improper authorization