CRITICAL
APSB24-73: Security update available for Adobe Commerce
Published Oct 8, 2024.
APSB24-73 (published 2024-10-08) fixes 1 CVE in Adobe Commerce and Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier; fixed in 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11.
Improper authentication (CVE-2024-45115) that allows privilege escalation without prior authentication. Part of the October 2024 patch set that followed the CosmicSting exploitation wave.
- Published
- Oct 8, 2024
- Severity
- critical
- CVEs
- 1
- Isolated patch
- no
CVEs
| CVE | CVSS | Type | Impact | Auth required |
|---|---|---|---|---|
| CVE-2024-45115 | 9.8 | improper-authentication | privilege-escalation | no |
Fixed in
- Mage-OS
- —
References
For integrators
Get this bulletin as JSON:
curl -s https://magento.watch/api/v1/security-bulletins/APSB24-73
