From 733afdcd8a357a08af072472d4c9f4d366327960 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 16 Sep 2024 20:11:11 +0000 Subject: [PATCH] Publish Advisories GHSA-4323-f82v-f6jr GHSA-4cj6-f32v-6hgx GHSA-7472-vw39-g2j3 GHSA-rf4q-m23c-7q8r GHSA-4323-f82v-f6jr GHSA-4cj6-f32v-6hgx GHSA-7472-vw39-g2j3 GHSA-rf4q-m23c-7q8r --- .../GHSA-4323-f82v-f6jr.json | 158 ++++++++++++++++++ .../GHSA-4cj6-f32v-6hgx.json | 158 ++++++++++++++++++ .../GHSA-7472-vw39-g2j3.json | 158 ++++++++++++++++++ .../GHSA-rf4q-m23c-7q8r.json | 158 ++++++++++++++++++ .../GHSA-4323-f82v-f6jr.json | 38 ----- .../GHSA-4cj6-f32v-6hgx.json | 38 ----- .../GHSA-7472-vw39-g2j3.json | 38 ----- .../GHSA-rf4q-m23c-7q8r.json | 38 ----- 8 files changed, 632 insertions(+), 152 deletions(-) create mode 100644 advisories/github-reviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json diff --git a/advisories/github-reviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json b/advisories/github-reviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json new file mode 100644 index 00000000000..839ce618199 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json @@ -0,0 +1,158 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4323-f82v-f6jr", + "modified": "2024-09-16T20:09:42Z", + "published": "2024-08-14T12:35:02Z", + "aliases": [ + "CVE-2024-39410" + ], + "summary": "Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability", + "details": "Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.7-p1" + }, + { + "fixed": "2.4.7-p2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.7" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.6-p1" + }, + { + "fixed": "2.4.6-p7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.6" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.5-p1" + }, + { + "fixed": "2.4.5-p9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.5" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.4-p10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.4" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39410" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T20:09:42Z", + "nvd_published_at": "2024-08-14T12:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json b/advisories/github-reviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json new file mode 100644 index 00000000000..579f2246079 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json @@ -0,0 +1,158 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4cj6-f32v-6hgx", + "modified": "2024-09-16T20:09:17Z", + "published": "2024-08-14T12:35:02Z", + "aliases": [ + "CVE-2024-39408" + ], + "summary": "Magento Open Source Cross-Site Request Forgery vulnerability", + "details": "Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.7-p1" + }, + { + "fixed": "2.4.7-p2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.7" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.6-p1" + }, + { + "fixed": "2.4.6-p7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.6" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.5-p1" + }, + { + "fixed": "2.4.5-p9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.5" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.4-p10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.4" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39408" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T20:09:17Z", + "nvd_published_at": "2024-08-14T12:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json b/advisories/github-reviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json new file mode 100644 index 00000000000..8eb7d1f1cce --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json @@ -0,0 +1,158 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7472-vw39-g2j3", + "modified": "2024-09-16T20:10:08Z", + "published": "2024-08-14T12:35:02Z", + "aliases": [ + "CVE-2024-39412" + ], + "summary": "Magento Open Source Improper Authorization vulnerability", + "details": "Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.7-p1" + }, + { + "fixed": "2.4.7-p2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.7" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.6-p1" + }, + { + "fixed": "2.4.6-p7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.6" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.5-p1" + }, + { + "fixed": "2.4.5-p9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.5" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.4-p10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.4" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39412" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T20:10:08Z", + "nvd_published_at": "2024-08-14T12:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json b/advisories/github-reviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json new file mode 100644 index 00000000000..e98bb9817c8 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json @@ -0,0 +1,158 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rf4q-m23c-7q8r", + "modified": "2024-09-16T20:09:34Z", + "published": "2024-08-14T12:35:02Z", + "aliases": [ + "CVE-2024-39409" + ], + "summary": "Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability", + "details": "Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.7-p1" + }, + { + "fixed": "2.4.7-p2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.7" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.6-p1" + }, + { + "fixed": "2.4.6-p7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.6" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.5-p1" + }, + { + "fixed": "2.4.5-p9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.5" + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.4-p10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "versions": [ + "2.4.4" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39409" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T20:09:33Z", + "nvd_published_at": "2024-08-14T12:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json b/advisories/unreviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json deleted file mode 100644 index ce9906c18c2..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-4323-f82v-f6jr/GHSA-4323-f82v-f6jr.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4323-f82v-f6jr", - "modified": "2024-08-14T12:35:02Z", - "published": "2024-08-14T12:35:02Z", - "aliases": [ - "CVE-2024-39410" - ], - "details": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39410" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-14T12:15:27Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json b/advisories/unreviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json deleted file mode 100644 index 532e8d2b426..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-4cj6-f32v-6hgx/GHSA-4cj6-f32v-6hgx.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4cj6-f32v-6hgx", - "modified": "2024-08-14T12:35:02Z", - "published": "2024-08-14T12:35:02Z", - "aliases": [ - "CVE-2024-39408" - ], - "details": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39408" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-14T12:15:26Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json b/advisories/unreviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json deleted file mode 100644 index 92053b62eac..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-7472-vw39-g2j3/GHSA-7472-vw39-g2j3.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7472-vw39-g2j3", - "modified": "2024-08-14T12:35:02Z", - "published": "2024-08-14T12:35:02Z", - "aliases": [ - "CVE-2024-39412" - ], - "details": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39412" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-285" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-14T12:15:27Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json b/advisories/unreviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json deleted file mode 100644 index 5f2b75f7283..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-rf4q-m23c-7q8r/GHSA-rf4q-m23c-7q8r.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rf4q-m23c-7q8r", - "modified": "2024-08-14T12:35:02Z", - "published": "2024-08-14T12:35:02Z", - "aliases": [ - "CVE-2024-39409" - ], - "details": "Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39409" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb24-61.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-14T12:15:26Z" - } -} \ No newline at end of file