Skip to content
OpenAdvisories
Medium WID-SEC-2025-0765 5 CVEs

Adobe Magento: Mehrere Schwachstellen

Published Apr 8, 2025 · Updated Apr 8, 2025 · de-DE

Vendor: Adobe Product: Magento Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um seine Privilegien zu erhöhen, einen Denial of Service auszulösen oder Sicherheitsvorkehrungen zu umgehen.

Product

Magento ist ein Online-Shop System von Adobe.

Vulnerabilities 5

  • Medium 5.3
    CVE-2025-27190

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 5.3
    CVE-2025-27191

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 4.3
    CVE-2025-27188

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measu…

    Adobe Adobe Commerce magento/community-edition Packagist
  • Medium 4.3
    CVE-2025-27189

    Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in use…

    Adobe Adobe Commerce
  • Low 2.7
    CVE-2025-27192

    Adobe Commerce | Insufficiently Protected Credentials (CWE-522)

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnera…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Revision history

  1. #1

    Initiale Fassung

References