CVE-2024-20718CWE-352

[Spain] CSRF to delete Requisition Lists at Adobe Commerce

Medium · published February 15, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.8th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2024-02-15T13:39Z
EPSS history
Timeline
  • 15 FEB 13:39Z
    [Spain] CSRF to delete Requisition Lists at Adobe Commerce
    cvelistv5