CVE-2022-34256
published 2022-08-16CVE-2022-34256: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.88%
77.0th percentile
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | — | — |
| adobe | commerce | >= 2.3.0 < 2.3.7 | 2.3.7 |
| adobe | commerce | >= 2.4.0 < 2.4.3 | 2.4.3 |
| adobe | magento_commerce | unspecified – 2.4.4 | — |
| linux | linux_kernel | >= 0 < 4.4.0-252.286 | 4.4.0-252.286 |
| magento | community-edition | >= 2.3.0 < 2.3.7-p4 | 2.3.7-p4 |
| magento | community-edition | >= 2.4.0 < 2.4.3-p3 | 2.4.3-p3 |
| magento | community-edition | >= 2.4.4 < 2.4.5 | 2.4.5 |
| magento | magento | — | — |
| magento | magento | — | — |
| magento | magento | — | — |
| magento | magento | >= 2.3.0 < 2.3.7 | 2.3.7 |
| magento | magento | >= 2.4.0 < 2.4.3 | 2.4.3 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-aws vulnerabilities
osv·2024-03-21·CVSS 6.4
CVE-2022-20567 linux-aws vulnerabilities
linux-aws vulnerabilities
It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation
in the Linux kernel contained a race condition when releasing PPPoL2TP
sockets in certain conditions, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20567)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle block device modification while it is
mounted. A privileged attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-34256)
Eric Dumazet discovered that the netfilter subsystem in the Linux kernel
did not properly handle DCCP conntrack buffers in certain
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-03-18·CVSS 6.4
CVE-2022-20567 linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation
in the Linux kernel contained a race condition when releasing PPPoL2TP
sockets in certain conditions, leading to a use-after-free vulnerability.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20567)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle block device modification while it is
mounted. A privileged attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-34256)
Eric Dumazet discovered that the netfilter subsystem in the Linux kernel
did not properly handl
OSV
Magento Improper Authorization vulnerability
osv·2022-08-17
CVE-2022-34256 [HIGH] Magento Improper Authorization vulnerability
Magento Improper Authorization vulnerability
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
GHSA
Magento Improper Authorization vulnerability
ghsa·2022-08-17
CVE-2022-34256 [HIGH] CWE-285 Magento Improper Authorization vulnerability
Magento Improper Authorization vulnerability
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-16
Published