{"id":"CVE-2022-35689","published":"2022-10-14T19:48:16Z","modified":"2025-04-23T16:47:08Z","title":"Adobe Commerce Improper Access Control Security feature bypass","vendor":"Adobe","product":"Magento Commerce","tier":"tail","description":{"text":"Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01439,"percentile":0.73166,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb22-48.html","tags":[]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":14.63},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Magento Commerce","versions":[">= unspecified, <= 2.4.5",">= unspecified, <= 2.4.4-p1",">= unspecified, <= None"]}],"affected":[{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.4-p1, <2.4.4-p2",">=2.4.3-p1, <=2.4.3-p3"],"patched":["2.4.4-p2"],"from":["GHSA-5fxx-jwjm-x9hj"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-5fxx-jwjm-x9hj"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-38565","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-adobe-magento-commerce-cve-2022-35689","packageHistory":[{"cve":"CVE-2022-24086","published":"2022-02-16","fixed":"2.4.3-p2","kev":true},{"cve":"CVE-2022-24093","published":"2023-09-12","fixed":"2.4.3-p2","kev":false},{"cve":"CVE-2022-35692","published":"2022-08-19","fixed":"2.4.3-p3","kev":false},{"cve":"CVE-2022-35689","published":"2022-10-14","fixed":"2.4.4-p2","kev":false},{"cve":"CVE-2022-34253","published":"2022-08-16","fixed":"2.4.5","kev":false},{"cve":"CVE-2022-34254","published":"2022-08-16","fixed":"2.4.5","kev":false},{"cve":"CVE-2022-34255","published":"2022-08-16","fixed":"2.4.5","kev":false},{"cve":"CVE-2023-22247","published":"2023-03-27","fixed":"2.4.5-p2","kev":false,"link":{"from":"CVE-2022-35689","to":"CVE-2023-22247","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:magento/community-edition","fromFixed":"2.4.4-p2","toFixed":"2.4.4-p3","daysApart":164}]}},{"cve":"CVE-2023-22250","published":"2023-03-27","fixed":"2.4.5-p2","kev":false,"link":{"from":"CVE-2022-35689","to":"CVE-2023-22250","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:magento/community-edition","fromFixed":"2.4.4-p2","toFixed":"2.4.4-p3","daysApart":164},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2023-22251","published":"2023-03-27","fixed":"2.4.5-p2","kev":false,"link":{"from":"CVE-2022-35689","to":"CVE-2023-22251","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:magento/community-edition","fromFixed":"2.4.4-p2","toFixed":"2.4.4-p3","daysApart":164}]}}],"package":"Packagist:magento/community-edition"}}