Adobe Magento Commerce vulnerabilities

2 CVEs affecting Adobe Magento Commerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-35692, published 2022-08-19.

More from Adobe.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-21012, published 2021-01-13. Medium severity, CVSS 5.3. EPSS: 4% chance of exploitation in the next 30 days. Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation…
• CVE-2022-35692, published 2022-08-19. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.…