CVE-2024-45115 CRITICAL

CVE-2024-45115: Adobe Commerce | Improper Authentication (CWE-287)

Vendor Adobe
Product Adobe Commerce
Weakness CWE-287 · Improper authentication
Published October 10, 2024
Last update October 10, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction.

Key dates

02Disclosure timeline

October 10, 2024 CVE published
October 10, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-11186 On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-prem CVE-2025-14908 JeecgBoot Multi-Tenant Management SysTenantController.java improper authentication CVE-2026-10167 OUSL-GROUP-BrinaryBrains School Student Management System MY_Controller Login.php sign_auth_cookie improper authentication CVE-2024-42164 Disabling MFA without Authentication CVE-2025-15456 bg5sbk MiniCMS Publish page-edit.php improper authentication