Adobe has recently released a critical security update for its Adobe Commerce and Magento Open Source platforms. The purpose of this blog post is to cover the specifics of this update, the possible risks it minimizes, and actionable steps users can take to strengthen their security posture.

The security update, identified as APSB24-61, was released on Aug 13, 2024. It addresses critical vulnerabilities present in Adobe Commerce and Magento Open Source. These vulnerabilities, if exploited, could lead to arbitrary code execution, arbitrary file system read, security feature bypass and privilege escalation..

Affected Versions

The affected versions include various iterations of Adobe Commerce and Magento Open Source. Users of versions before the following are urged to take immediate action:

  • Adobe Commerce: 2.4.7-p1 and earlier, 2.4.6-p6 and earlier, 2.4.5-p8 and earlier, 2.4.4-p9 and earlier, and more.
  • Magento Open Source: 2.4.7-p1 and earlier, 2.4.6-p6 and earlier, 2.4.5-p8 and earlier, 2.4.4-p9 and earlier, and more.

Solution

Adobe has provided updated versions for both Adobe Commerce and Magento Open Source to address these vulnerabilities. Adobe has categorized the updates with the priority ratings and users are strongly advised to update their installations to the newest versions as soon as possible. Detailed installation instructions are available on Adobe’s website.

Vulnerability Details

The vulnerabilities encompass various categories, including Unrestricted Upload of File with Dangerous Type (CWE-434), Improper Restriction of Excessive Authentication Attempts (CWE-307), Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22), Cross-site Scripting (Stored XSS) (CWE-79), Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78), Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78), Cross-site Scripting (Stored XSS) (CWE-79), Information Exposure (CWE-200), Improper Access Control (CWE-284), Improper Access Control (CWE-284), Incorrect Authorization (CWE-863), Cross-Site Request Forgery (CSRF) (CWE-352), Cross-Site Request Forgery (CSRF) (CWE-352), Cross-Site Request Forgery (CSRF) (CWE-352), Improper Access Control (CWE-284), Improper Authorization (CWE-285), Improper Authorization (CWE-285), Improper Access Control (CWE-284), Improper Authorization (CWE-285), Improper Authorization (CWE-285), Improper Authorization (CWE-285), Improper Authorization (CWE-285) and Improper Access Control (CWE-284). These vulnerabilities pose the risk of arbitrary code execution, arbitrary file system read, security feature bypass and privilege escalation.

You can find detailed information here: Adobe Security Bulletin APSB24-61.