Description Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim into executing unintended actions on a web application where the victim is authenticated, potentially allowing unauthorized access or modification of sensitive data. Exploitation of this issue requires user interaction in that a victim must visit a malicious website or click on a crafted link. Scope is changed.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Adobe Commerce and Magento Open Source versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier. This vulnerability could lead to privilege escalation, allowing a high-privileged attacker to manipulate actions on behalf of an authenticated user, potentially resulting in unauthorized access to or modification of sensitive data. Exploitation requires user interaction, as the victim must visit a malicious website or click on a crafted link.
Users are advised to update to Adobe Commerce or Magento Open Source versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12 or 2.4.5-p14. Instructions for updating can be found in the 2.4.x release notes.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 13, 2025 Exploitation: NoneAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions adobe commerce < 2.4.4
2.4.4 -
2.4.4 p1
2.4.4 p10
2.4.4 p11
2.4.4 p12
2.4.4 p13
2.4.4 p14
2.4.4 p2
2.4.4 p3
2.4.4 p4
2.4.4 p5
2.4.4 p6
2.4.4 p7
2.4.4 p8
2.4.4 p9
2.4.5 -
2.4.5 p1
2.4.5 p10
2.4.5 p11
2.4.5 p12
2.4.5 p13
2.4.5 p2
2.4.5 p3
2.4.5 p4
2.4.5 p5
2.4.5 p6
2.4.5 p7
2.4.5 p8
2.4.5 p9
2.4.6 -
2.4.6 p1
2.4.6 p10
2.4.6 p11
2.4.6 p2
2.4.6 p3
2.4.6 p4
2.4.6 p5
2.4.6 p6
2.4.6 p7
2.4.6 p8
2.4.6 p9
2.4.7 -
2.4.7 b1
2.4.7 b2
2.4.7 beta3
2.4.7 p1
2.4.7 p2
2.4.7 p3
2.4.7 p4
2.4.7 p5
2.4.7 p6
2.4.8 -
2.4.8 beta1
Viewing 5 of 54 versions. View all CPE cpe:2.3:a:adobe:commerce:*:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p12:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p13:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:b1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:b2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:beta3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.8:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.8:beta1:*:*:*:*:*:* Remediation No remediation found in references. adobe commerce b2b < 1.3.3
1.3.3 -
1.3.3 p1
1.3.3 p10
1.3.3 p11
1.3.3 p12
1.3.3 p13
1.3.3 p14
1.3.3 p2
1.3.3 p3
1.3.3 p4
1.3.3 p5
1.3.3 p6
1.3.3 p7
1.3.3 p8
1.3.3 p9
1.3.4 -
1.3.4 p1
1.3.4 p10
1.3.4 p11
1.3.4 p12
1.3.4 p13
1.3.4 p2
1.3.4 p3
1.3.4 p4
1.3.4 p5
1.3.4 p6
1.3.4 p7
1.3.4 p8
1.3.4 p9
1.3.5 -
1.3.5 p1
1.3.5 p10
1.3.5 p11
1.3.5 p2
1.3.5 p3
1.3.5 p4
1.3.5 p5
1.3.5 p6
1.3.5 p7
1.3.5 p8
1.3.5 p9
1.4.2 -
1.4.2 p1
1.4.2 p2
1.4.2 p3
1.4.2 p4
1.4.2 p5
1.4.2 p6
1.5.2 -
1.5.2 p1
1.5.3 alpha1
Viewing 5 of 52 versions. View all CPE cpe:2.3:a:adobe:commerce_b2b:*:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p12:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p13:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p14:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.3:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p12:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p13:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p10:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p11:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.3.5:p9:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.4.2:p6:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.5.2:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.5.2:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce_b2b:1.5.3:alpha1:*:*:*:*:*:* Remediation No remediation found in references. adobe magento < 2.4.5
2.4.5 -
2.4.5 p1
2.4.5 p10
2.4.5 p11
2.4.5 p12
2.4.5 p13
2.4.5 p2
2.4.5 p3
2.4.5 p4
2.4.5 p5
2.4.5 p6
2.4.5 p7
2.4.5 p8
2.4.5 p9
2.4.6 -
2.4.6 p1
2.4.6 p10
2.4.6 p11
2.4.6 p2
2.4.6 p3
2.4.6 p4
2.4.6 p5
2.4.6 p6
2.4.6 p7
2.4.6 p8
2.4.6 p9
2.4.7 -
2.4.7 b1
2.4.7 b2
2.4.7 beta3
2.4.7 p1
2.4.7 p2
2.4.7 p3
2.4.7 p4
2.4.7 p5
2.4.7 p6
2.4.8 -
2.4.8 beta1
2.4.8 beta2
2.4.8 p1
2.4.9 alpha1
Viewing 5 of 42 versions. View all CPE cpe:2.3:a:adobe:magento:*:-:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p10:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p11:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p12:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p13:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p8:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.5:p9:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p10:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p11:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p6:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p7:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p8:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.6:p9:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:-:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:b2:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:beta3:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:p1:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:p2:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:p3:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:p4:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:p5:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.7:p6:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.8:-:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.8:beta1:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.8:beta2:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.8:p1:*:*:open_source:*:*:* cpe:2.3:a:adobe:magento:2.4.9:alpha1:*:*:open_source:*:*:* Remediation No remediation found in references.
Change History 4 change records found show changes