CVE-2024-49521
Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
- State
- Published
- Severity
- 7.7 High
- Published
- Nov 12, 2024
- Updated
- Nov 12, 2024
- Reserved
- Oct 15, 2024
Description
Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | adobe |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF) (CWE-918)
Affected Products
| Product | Versions |
|---|---|
Adobe CommerceAdobe |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.