CVE-2025-24409:
Adobe Commerce Improper Authorization vulnerability
8.2
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.32499%
CWE
Published
2/11/2025
Updated
3/17/2025
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.4.7-beta1, < 2.4.7-p4 | 2.4.7-p4 |
| magento/community-edition | composer | >= 2.4.6-p1, < 2.4.6-p9 | 2.4.6-p9 |
| magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p11 | 2.4.5-p11 |
| magento/community-edition | composer | < 2.4.4-p12 | 2.4.4-p12 |
| magento/community-edition | composer | = 2.4.7 | |
| magento/community-edition | composer | = 2.4.6 | |
| magento/community-edition | composer | = 2.4.5 | |
| magento/community-edition | composer | = 2.4.4 | |
| magento/community-edition | composer | = 2.4.8-beta1 | |
| magento/project-community-edition | composer | <= 2.0.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability centers on improper authorization (CWE-285/CWE-863) in Adobe Commerce. Magento's admin controllers typically require explicit authorization checks via the _isAllowed() method. The absence of these checks in critical admin endpoints (like AdminNotification or Integration modules) would align with the described security bypass. Similarly, misconfigured API endpoints in webapi.xml could allow privilege escalation. These hypotheses align with historical Magento authorization flaws and the CVSS vector (network-accessible, no privileges required). Confidence is medium due to lack of direct patch details, but the patterns match the vulnerability's characteristics.