Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Adobe Commerce can let attackers bypass security features

CVE-2022-34259 · published 4 years ago
Summary

Versions of Adobe Commerce up through 2.4.3‑p2, 2.3.7‑p3 and 2.4.4 allow someone to skip built‑in security checks. This could let an attacker disrupt a small part of the system without any user action. Upgrade to the newest release or apply the vendor’s patch to close the gap.

What to do
  • Update magento community-edition to version 2.3.7-p4.
  • Update magento community-edition to version 2.4.5.
  • Update magento community-edition to version 2.4.3-p3.
Affected software
Ecosystem VendorProductAffected versions
composer magento community-edition >= 2.3.0, < 2.3.7-p4
>= 2.4.4, < 2.4.5
>= 2.4.0, < 2.4.3-p3
Fix: upgrade to 2.3.7-p4
– adobe commerce >= 2.3.0, < 2.3.7
>= 2.4.0, < 2.4.3
2.3.7
2.4.3
2.4.4
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
– magento magento >= 2.3.0, < 2.3.7
>= 2.4.0, < 2.4.3
2.3.7
2.4.3
2.4.4
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*
Original advisory text
Adobe Commerce Improper Access Control Security feature bypass
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published16 Aug 2022
Updated2 Nov 2026
First seen6 Mar 2026
Sources
GHSA-9wjf-94h3-r4rh · GHSA
CVE-2022-34259 · NVD
CVE-2022-34259 · OSV
Track software like this
Free during beta