Skip to content
OpenAdvisories
High NCSC-2025-0191 5 CVEs

Kwetsbaarheden verholpen in Adobe Commerce en Magento

Published Jun 11, 2025 · Updated Jun 11, 2025 · nl

Vendor: Adobe Product: Commerce Product: Commerce B2B Product: Magento Open Source

Summary

Adobe heeft kwetsbaarheden verholpen in Adobe Commerce en Magento Open Source.

Details

Interpretaties
De kwetsbaarheden bevinden zich in de manier waarop Adobe Commerce omgaat met beveiligingsmaatregelen. Aanvallers met verhoogde rechten kunnen misbruik maken van een opgeslagen Cross-Site Scripting (XSS) kwetsbaarheid door kwaadaardige scripts in formulier velden te injecteren, wat kan leiden tot de uitvoering van schadelijke JavaScript in de browsers van gebruikers. Daarnaast zijn er kwetsbaarheden die het mogelijk maken voor aanvallers om beveiligingsmaatregelen te omzeilen, waardoor ongeautoriseerde toegang tot gevoelige delen van de applicatie mogelijk is zonder enige gebruikersinteractie. Dit kan leiden tot ongeautoriseerde wijzigingen en toegang tot gevoelige informatie.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 5

  • High 8.4
    CVE-2025-47110

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. …

    Adobe Adobe Commerce magento/community-edition Packagist
  • High 8.2
    CVE-2025-43585

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measu…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.1
    CVE-2025-43586

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass secu…

    Adobe Adobe Commerce
  • Medium 6.5
    CVE-2025-27207

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass secu…

    Adobe Adobe Commerce
  • Medium 5.3
    CVE-2025-27206

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security meas…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Revision history

  1. #1.0.0

    Initiele versie

References