Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Adobe Commerce allows low-level users to take over accounts

CVE-2022-34255 · published 4 years ago
Summary

Versions of Adobe Commerce up to 2.4.4 let someone with a basic user account gain higher privileges and hijack another user's account. This can happen without the victim clicking anything. Update to the latest release or apply the vendor's security patch to stop it.

What to do
  • Update magento community-edition to version 2.3.7-p4.
  • Update magento community-edition to version 2.4.5.
  • Update magento community-edition to version 2.4.3-p3.
Affected software
Ecosystem VendorProductAffected versions
composer magento community-edition >= 2.3.0, < 2.3.7-p4
>= 2.4.4, < 2.4.5
>= 2.4.0, < 2.4.3-p3
Fix: upgrade to 2.3.7-p4
– adobe commerce >= 2.3.0, < 2.3.7
>= 2.4.0, < 2.4.3
2.3.7
2.4.3
2.4.4
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
– magento magento >= 2.3.0, < 2.3.7
>= 2.4.0, < 2.4.3
2.3.7
2.4.3
2.4.4
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*
Original advisory text
Adobe Commerce Improper Access Control Privilege escalation
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover for a victim. Exploitation of this issue does not require user interaction.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-284Improper Access Control
CWE-863Incorrect Authorization
Timeline
Published16 Aug 2022
Updated2 Nov 2026
First seen6 Mar 2026
Sources
GHSA-x95x-f4g9-mm85 · GHSA
CVE-2022-34255 · NVD
CVE-2022-34255 · OSV
Track software like this
Free during beta