← back
CVE-2024-20718

[Spain] CSRF to delete Requisition Lists at Adobe Commerce

CVSS 4.3 MEDIUMEPSS 0.8%CWE-352
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 4.3EPSS 0.8%KEV nãoPoC Nuclei Metasploit Patch referenciado
Lifecycle
15 Feb 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
Adobe · Adobe Commerce

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →