{"id":"CVE-2022-35692","published":"2022-08-19T22:49:21Z","modified":"2025-04-23T17:48:04Z","title":"Adobe Commerce Improper Access Control Security feature bypass","vendor":"Adobe","product":"Magento Commerce","tier":"tail","description":{"text":"Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account detials. Exploitation of this issue does not require user interaction.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00837,"percentile":0.57628,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb22-38.html","tags":["x_refsource_MISC"]}],"priority":{"score":15.2,"factors":[{"name":"EPSS percentile","points":11.53},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Magento Commerce","versions":[">= unspecified, <= 2.4.4",">= unspecified, <= 2.3.7-p3",">= unspecified, <= 2.4.3-p2",">= unspecified, <= None"]}],"affected":[{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.3-p1, <2.4.3-p3",">=2.3.7-p1, <2.3.7-p4"],"patched":["2.4.3-p3","2.3.7-p4"],"from":["GHSA-gm4m-9rm8-7rxj"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-gm4m-9rm8-7rxj"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-38568","exploited":false,"provenance":"source"}}