Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
1.3
CVE-2023-29294: Adobe Commerce B2B allows purchase order approval to be bypassed
CVE-2023-29294 · published 3 years ago
Summary
Adobe Commerce (including Magento Community Edition) versions up to 2.4.6 let a low‑privilege user skip the purchase order approval step. This can happen automatically, without any other user clicking anything. Apply the latest security patches or upgrade to a newer version to close the gap.
What to do
- Update magento community-edition to version 2.4.5-p3.
- Update magento community-edition to version 2.4.4-p4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | magento | community-edition |
2.4.6 2.4.5 2.4.4 >= 2.4.5-p1, < 2.4.5-p3 >= 2.4.4-p1, < 2.4.4-p4 Fix: upgrade to 2.4.5-p3
|
| composer | magento | project-community-edition | <= 2.0.2 |
| – | adobe | commerce |
2.3.7 2.4.0 2.4.1 2.4.2 2.4.3 2.4.4 2.4.5 2.4.6 cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:* |
| – | adobe | magento |
2.4.4 2.4.5 2.4.6 cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:* |
Original advisory text
Bypass Purchase Order Approval using Company User in Adobe Commerce B2B
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-840Business Logic Errors
Timeline
Published15 Jun 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta