Skip to content
OpenAdvisories
High NCSC-2025-0208 7 CVEs

Kwetsbaarheden verholpen in Adobe Commerce

Published Jun 30, 2025 · Updated Jun 30, 2025 · nl

Vendor: Adobe Product: Commerce Product: Commerce B2B Product: Magento Open Source

Summary

Adobe heeft kwetsbaarheden verholpen in Adobe Commerce (Versies 2.4.8 en eerder).

Details

Interpretaties
De kwetsbaarheden bevinden zich in de beveiligingsmechanismen van Adobe Commerce, waardoor zowel hoog- als laaggeprivilegieerde aanvallers in staat zijn om beveiligingsmaatregelen te omzeilen. Dit kan leiden tot ongeautoriseerde toegang tot gevoelige informatie en het uitvoeren van kwaadaardige scripts in de browsers van nietsvermoedende slachtoffers.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 7

  • High 8.4
    CVE-2025-47110

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. …

    Adobe Adobe Commerce magento/community-edition Packagist
  • High 8.2
    CVE-2025-43585

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measu…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.1
    CVE-2025-43586

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass secu…

    Adobe Adobe Commerce
  • Medium 6.5
    CVE-2025-27207

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass secu…

    Adobe Adobe Commerce
  • Medium 5.3
    CVE-2025-27206

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security meas…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 4.3
    CVE-2025-49550

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security meas…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Low 2.7
    CVE-2025-49549

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypas…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Revision history

  1. #1.0.0

    Initiele versie

References