Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Adobe Commerce can let unauthorized users export tax sales report

CVE-2024-39415 · published 2 years ago
Summary

Versions of Adobe Commerce and Magento up to 2.4.7‑p1 allow users with low privileges to export the Tax Sales Report without proper permission checks. This could let someone view financial details they should not see, and it can be triggered without any action from a legitimate user. Apply the latest security updates or patches from Adobe to close the gap.

What to do
  • Update magento community-edition to version 2.4.7-p2.
  • Update magento community-edition to version 2.4.6-p7.
  • Update magento community-edition to version 2.4.5-p9.
  • Update magento community-edition to version 2.4.4-p10.
Affected software
Ecosystem VendorProductAffected versions
composer magento project-community-edition <= 2.0.2
composer magento community-edition >= 2.4.7-beta1, < 2.4.7-p2
>= 2.4.6-p1, < 2.4.6-p7
>= 2.4.5-p1, < 2.4.5-p9
< 2.4.4-p10
2.4.4
2.4.5
2.4.6
2.4.7
Fix: upgrade to 2.4.7-p2
– adobe commerce <= 2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
– adobe magento <= 2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*
Original advisory text
An unauthorized user can export the Tax Sales Report
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
Timeline
Published14 Aug 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-gj93-84g5-mcjq · GHSA
CVE-2024-39415 · NVD
CVE-2024-39415 · OSV
Track software like this
Free during beta