Summary
Adobe heeft meerdere kwetsbaarheden verholpen in Adobe Commerce.
Details
Interpretaties
De kwetsbaarheden betreffen voornamelijk incorrecte autorisatie, waardoor een aanvaller met verschillende privilege-niveaus beveiligingscontroles kan omzeilen. Dit stelt de aanvaller in staat om zonder gebruikersinteractie ongeautoriseerde lees- en schrijfrechten te verkrijgen, toegang te krijgen tot gevoelige data, en privileges te escaleren binnen het systeem. Daarnaast is er een stored Cross-Site Scripting (XSS) kwetsbaarheid die het mogelijk maakt voor laaggeprivilegieerde aanvallers om kwaadaardige JavaScript-code in formulier velden te injecteren. Deze code wordt uitgevoerd in de browsers van slachtoffers, wat kan leiden tot ongeautoriseerde acties zoals sessiekaping en toegang tot gebruikersaccounts. De exploitatie van deze kwetsbaarheden kan leiden tot wijzigingen in de integriteit van het platform, ongeautoriseerde toegang tot bronnen en mogelijke verstoring van de beschikbaarheid.
Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden in Adobe Commerce te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 7
-
Critical 9.1
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user in…
KEV Sep 24, 2026 -
High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they bro…
-
High 7.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they bro…
-
High 7.6
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing…
-
High 7.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does…
-
Medium 6.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitat…
-
Low 2.7
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue doe…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://helpx.adobe.com/security/products/magento/apsb26-92.html