CVE-2022-42344

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb22-38.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:commerce::::::::
	cpe:2.3:a:adobe:commerce::::::::
	cpe:2.3:a:adobe:commerce:2.3.7:-::::::
	cpe:2.3:a:adobe:commerce:2.3.7:p1::::::
	cpe:2.3:a:adobe:commerce:2.3.7:p2::::::
	cpe:2.3:a:adobe:commerce:2.3.7:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.3:-::::::
	cpe:2.3:a:adobe:commerce:2.4.3:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.3:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.4:-::::::
	cpe:2.3:a:magento:magento:::::open_source:::*
	cpe:2.3:a:magento:magento:::::open_source:::*
	cpe:2.3:a:magento:magento:2.3.7:-:::open_source:::*
	cpe:2.3:a:magento:magento:2.3.7:p1:::open_source:::*
	cpe:2.3:a:magento:magento:2.3.7:p2:::open_source:::*
	cpe:2.3:a:magento:magento:2.3.7:p3:::open_source:::*
	cpe:2.3:a:magento:magento:2.4.3:-:::open_source:::*
	cpe:2.3:a:magento:magento:2.4.3:p1:::open_source:::*
	cpe:2.3:a:magento:magento:2.4.3:p2:::open_source:::*
	cpe:2.3:a:magento:magento:2.4.4:-:::open_source:::*

History

No history.

Information

Published : 2022-10-20 17:15

Updated : 2023-12-04 17:33

NVD link : CVE-2022-42344

Mitre link : CVE-2022-42344

CVE.ORG link : CVE-2022-42344

JSON object : View

Products Affected

magento

magento

adobe

commerce

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2022-42344", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-10-20T17:15:10.723", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation."}, {"lang": "es", "value": "Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) est\u00e1n afectadas por una vulnerabilidad de comprobaci\u00f3n de entrada inapropiada. Un atacante autenticado puede desencadenar una referencia de objeto directa insegura en el endpoint \"V1/customers/me\" para lograr una exposici\u00f3n de informaci\u00f3n y una escalada de privilegios"}], "lastModified": "2023-12-04T17:33:35.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D3D4DD8-EBF6-4281-B103-CB85CFCAA4C0", "versionEndExcluding": "2.3.7"}, {"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF96C367-576B-437B-A86C-CB9CA65CB481", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A453C85-A14A-47B8-B91D-3906BBE42A78"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38FFC3BA-B75E-4060-9E29-74367C7BE8A8"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "9DF037A1-026B-4083-97FB-13578A56326C", "versionEndExcluding": "2.3.7"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "B865822D-748C-420A-A116-9A2254A11D75", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0"}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "4F1E5426-A646-4EC1-902A-FD30B00AD1AA"}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p1:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D29DD6-93EA-4740-96FE-032AA219D1E7"}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p2:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "97FC8827-5A1E-4F5B-AE87-77B32D4309AD"}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p3:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "091B6125-E08F-430B-8F7C-AF99AB525CE8"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:-:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "21DC0F2F-D401-45C3-A4BC-B3C34BFD84B7"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p1:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "3ECBE809-A545-40B7-892C-ACEBFC76E886"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p2:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "360125BA-CA99-41D7-BA88-6FA4372A4BFB"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.4:-:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "3F7E6786-3F2D-40AA-9C2A-4B6E1391C379"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}