CVE-2024-20718
[Spain] CSRF to delete Requisition Lists at Adobe Commerce
- State
- Published
- Severity
- 4.3 Medium
- Published
- Feb 15, 2024
- Updated
- Aug 1, 2024
- Reserved
- Dec 4, 2023
Description
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | adobe |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF) (CWE-352)
Affected Products
| Product | Versions |
|---|---|
Adobe CommerceAdobe |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.