SSRF in Adobe Commerce
CVE-2024-49521
Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.007 (47.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Adobe Commerce — versions 0
- Adobe Commerce
- Adobe Magento
Weakness classification (CWE)
References
- psirt@adobe.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-49521?
- CVE-2024-49521 is a high-severity vulnerability in Adobe Commerce, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.7/10. Published 2024-11-12.
- How severe is CVE-2024-49521?
- High severity. CVSS v3 base score is 7.7 out of 10.