CVE-2022-42344 - Vulnerability Details

Vendors	Products
Adobe	Commerce
Magento	Magento

Link	Providers
https://helpx.adobe.com/security/products/magento/apsb22-38.html

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-42344", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "dateUpdated": "2024-09-16T16:28:52.349Z", "dateReserved": "2022-10-03T00:00:00", "datePublished": "2022-10-20T16:28:18.473424Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Adobe Commerce", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2.4.3-p2", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2022-08-09T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "LOW", "modifiedScope": "NOT_DEFINED", "modifiedUserInteraction": "NONE", "privilegesRequired": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "Incorrect Authorization (CWE-863)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2023-10-24T10:53:58.410Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}], "source": {"discovery": "EXTERNAL"}, "title": "[CVE-2021-36032] Magento IDOR Leads to Account Takeover"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:03:45.980Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-42344 (string)

assignerOrgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

assignerShortName : adobe (string)

dateUpdated : 2024-09-16T16:28:52.349Z (string)

dateReserved : 2022-10-03T00:00:00 (string)

datePublished : 2022-10-20T16:28:18.473424Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : affected (string)

product : Adobe Commerce (string)

vendor : Adobe (string)

versions : [ »

0 : { »

lessThanOrEqual : 2.4.3-p2 (string)

status : affected (string)

version : 0 (string)

versionType : semver (string)

}

]

}

]

datePublic : 2022-08-09T17:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

availabilityRequirement : NOT_DEFINED (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

confidentialityRequirement : NOT_DEFINED (string)

environmentalScore : 8.8 (number)

environmentalSeverity : HIGH (string)

exploitCodeMaturity : NOT_DEFINED (string)

integrityImpact : HIGH (string)

integrityRequirement : NOT_DEFINED (string)

modifiedAttackComplexity : LOW (string)

modifiedAttackVector : NETWORK (string)

modifiedAvailabilityImpact : HIGH (string)

modifiedConfidentialityImpact : HIGH (string)

modifiedIntegrityImpact : HIGH (string)

modifiedPrivilegesRequired : LOW (string)

modifiedScope : NOT_DEFINED (string)

modifiedUserInteraction : NONE (string)

privilegesRequired : LOW (string)

remediationLevel : NOT_DEFINED (string)

reportConfidence : NOT_DEFINED (string)

scope : UNCHANGED (string)

temporalScore : 8.8 (number)

temporalSeverity : HIGH (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-863 (string)

description : Incorrect Authorization (CWE-863) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

shortName : adobe (string)

dateUpdated : 2023-10-24T10:53:58.410Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : [CVE-2021-36032] Magento IDOR Leads to Account Takeover (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T13:03:45.980Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "9D3D4DD8-EBF6-4281-B103-CB85CFCAA4C0", "versionEndExcluding": "2.3.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF96C367-576B-437B-A86C-CB9CA65CB481", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*", "matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*", "matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*", "matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*", "matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*", "matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*", "matchCriteriaId": "8A453C85-A14A-47B8-B91D-3906BBE42A78", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*", "matchCriteriaId": "38FFC3BA-B75E-4060-9E29-74367C7BE8A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "matchCriteriaId": "9DF037A1-026B-4083-97FB-13578A56326C", "versionEndExcluding": "2.3.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "matchCriteriaId": "B865822D-748C-420A-A116-9A2254A11D75", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*", "matchCriteriaId": "4F1E5426-A646-4EC1-902A-FD30B00AD1AA", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p1:*:*:open_source:*:*:*", "matchCriteriaId": "E1D29DD6-93EA-4740-96FE-032AA219D1E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p2:*:*:open_source:*:*:*", "matchCriteriaId": "97FC8827-5A1E-4F5B-AE87-77B32D4309AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p3:*:*:open_source:*:*:*", "matchCriteriaId": "091B6125-E08F-430B-8F7C-AF99AB525CE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:-:*:*:open_source:*:*:*", "matchCriteriaId": "21DC0F2F-D401-45C3-A4BC-B3C34BFD84B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p1:*:*:open_source:*:*:*", "matchCriteriaId": "3ECBE809-A545-40B7-892C-ACEBFC76E886", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p2:*:*:open_source:*:*:*", "matchCriteriaId": "360125BA-CA99-41D7-BA88-6FA4372A4BFB", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.4:-:*:*:open_source:*:*:*", "matchCriteriaId": "3F7E6786-3F2D-40AA-9C2A-4B6E1391C379", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation."}, {"lang": "es", "value": "Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) est\u00e1n afectadas por una vulnerabilidad de comprobaci\u00f3n de entrada inapropiada. Un atacante autenticado puede desencadenar una referencia de objeto directa insegura en el endpoint \"V1/customers/me\" para lograr una exposici\u00f3n de informaci\u00f3n y una escalada de privilegios"}], "id": "CVE-2022-42344", "lastModified": "2024-11-21T07:24:47.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "psirt@adobe.com", "type": "Secondary"}]}, "published": "2022-10-20T17:15:10.723", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "psirt@adobe.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 9D3D4DD8-EBF6-4281-B103-CB85CFCAA4C0 (string)

versionEndExcluding : 2.3.7 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* (string)

matchCriteriaId : BF96C367-576B-437B-A86C-CB9CA65CB481 (string)

versionEndExcluding : 2.4.3 (string)

versionStartIncluding : 2.4.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:* (string)

matchCriteriaId : 4346BF61-743B-4BBE-AC90-9954FEE6E943 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:* (string)

matchCriteriaId : 9F471E19-8AFE-4A6C-88EA-DF94428518F7 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:* (string)

matchCriteriaId : 27E5B990-1E1C-46AC-815F-AF737D211C16 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:* (string)

matchCriteriaId : 8D1598F4-AA41-4F94-A986-E603DC42AC8B (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:* (string)

matchCriteriaId : 7B503C35-8C90-4A24-8E60-722CDBBF556B (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:* (string)

matchCriteriaId : 8A453C85-A14A-47B8-B91D-3906BBE42A78 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:* (string)

matchCriteriaId : 38FFC3BA-B75E-4060-9E29-74367C7BE8A8 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:* (string)

matchCriteriaId : D258D9EF-94FB-41F0-A7A5-7F66FA7A0055 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* (string)

matchCriteriaId : 9DF037A1-026B-4083-97FB-13578A56326C (string)

versionEndExcluding : 2.3.7 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* (string)

matchCriteriaId : B865822D-748C-420A-A116-9A2254A11D75 (string)

versionEndExcluding : 2.4.3 (string)

versionStartIncluding : 2.4.0 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:* (string)

matchCriteriaId : 4F1E5426-A646-4EC1-902A-FD30B00AD1AA (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:p1:*:*:open_source:*:*:* (string)

matchCriteriaId : E1D29DD6-93EA-4740-96FE-032AA219D1E7 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:p2:*:*:open_source:*:*:* (string)

matchCriteriaId : 97FC8827-5A1E-4F5B-AE87-77B32D4309AD (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:p3:*:*:open_source:*:*:* (string)

matchCriteriaId : 091B6125-E08F-430B-8F7C-AF99AB525CE8 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:magento:magento:2.4.3:-:*:*:open_source:*:*:* (string)

matchCriteriaId : 21DC0F2F-D401-45C3-A4BC-B3C34BFD84B7 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:magento:magento:2.4.3:p1:*:*:open_source:*:*:* (string)

matchCriteriaId : 3ECBE809-A545-40B7-892C-ACEBFC76E886 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:magento:magento:2.4.3:p2:*:*:open_source:*:*:* (string)

matchCriteriaId : 360125BA-CA99-41D7-BA88-6FA4372A4BFB (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:magento:magento:2.4.4:-:*:*:open_source:*:*:* (string)

matchCriteriaId : 3F7E6786-3F2D-40AA-9C2A-4B6E1391C379 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation. (string)

}

1 : { »

lang : es (string)

value : Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) están afectadas por una vulnerabilidad de comprobación de entrada inapropiada. Un atacante autenticado puede desencadenar una referencia de objeto directa insegura en el endpoint "V1/customers/me" para lograr una exposición de información y una escalada de privilegios (string)

}

]

id : CVE-2022-42344 (string)

lastModified : 2024-11-21T07:24:47.620 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : psirt@adobe.com (string)

type : Secondary (string)

}

]

}

published : 2022-10-20T17:15:10.723 (string)

references : [ »

0 : { »

source : psirt@adobe.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

}

]

sourceIdentifier : psirt@adobe.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : psirt@adobe.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object