CVE-2024-34109

Adobe Commerce | Improper Input Validation (CWE-20)

State: Published
Severity: 7.2 High
Published: Jun 13, 2024
Updated: Sep 17, 2024
Reserved: Apr 30, 2024

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	adobe

Weaknesses

CWE-20 Improper Input Validation (CWE-20)

Affected Products

Product	Versions
Adobe CommerceAdobe	2.4.4-p8 and earlierAffected

References

https://helpx.adobe.com/security/products/magento/apsb24-40.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.