SB2025021201 - Multiple vulnerabilities in Adobe Commerce and Magento Open Source
Published: February 12, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 31 secuirty vulnerabilities.
1) Stored cross-site scripting (CVE-ID: CVE-2025-24428)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Improper authorization (CVE-ID: CVE-2025-24434)
The vulnerability allows a remote attacker to compromise the affected application.
The vulnerability exists due to improper authorization. A remote non-authenticated attacker can execute arbitrary code on the system.
3) Stored cross-site scripting (CVE-ID: CVE-2025-24412)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Path traversal (CVE-ID: CVE-2025-24406)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
5) Incorrect authorization (CVE-ID: CVE-2025-24407)
The vulnerability allows a remote user to gain unauthorized access to the application.
The vulnerability exists due to incorrect authorization. A remote authenticated user can bypass implemented security restrictions.
6) Information disclosure (CVE-ID: CVE-2025-24408)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote user can gain unauthorized access to sensitive information on the system.
7) Improper authorization (CVE-ID: CVE-2025-24409)
The vulnerability allows a remote attacker to compromise the affected application.
The vulnerability exists due to improper authorization. A remote non-authenticated attacker can execute arbitrary code on the system.
8) Stored cross-site scripting (CVE-ID: CVE-2025-24410)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
9) Improper access control (CVE-ID: CVE-2025-24411)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and compromise the affected application.
10) Stored cross-site scripting (CVE-ID: CVE-2025-24438)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
11) Stored cross-site scripting (CVE-ID: CVE-2025-24413)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
12) Stored cross-site scripting (CVE-ID: CVE-2025-24414)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
13) Stored cross-site scripting (CVE-ID: CVE-2025-24415)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
14) Stored cross-site scripting (CVE-ID: CVE-2025-24416)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
15) Stored cross-site scripting (CVE-ID: CVE-2025-24417)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
16) Violation of secure design principles (CVE-ID: CVE-2025-24418)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to insecure design. A remote privileged user can escalate privileges within the application.
17) Incorrect authorization (CVE-ID: CVE-2025-24419)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to incorrect authorization. A remote user can bypass implemented security restrictions.
18) Incorrect authorization (CVE-ID: CVE-2025-24420)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to incorrect authorization. A remote user can bypass implemented security restrictions.
19) Incorrect authorization (CVE-ID: CVE-2025-24421)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to incorrect authorization. A remote user can bypass implemented security restrictions.
20) Improper access control (CVE-ID: CVE-2025-24422)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and gain unauthorized access to sensitive information.
21) Improper access control (CVE-ID: CVE-2025-24423)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.
22) Improper access control (CVE-ID: CVE-2025-24435)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to incorrect authorization. A remote user can bypass implemented security restrictions.
23) Improper access control (CVE-ID: CVE-2025-24436)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to incorrect authorization. A remote user can bypass implemented security restrictions.
24) Improper access control (CVE-ID: CVE-2025-24437)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to incorrect authorization. A remote user can bypass implemented security restrictions.
25) Improper access control (CVE-ID: CVE-2025-24424)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to incorrect authorization. A remote user can bypass implemented security restrictions and gain access to sensitive information.
26) Business Logic Errors (CVE-ID: CVE-2025-24425)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a business logic error. A remote non-authenticated attacker can bypass implemented security restrictions.
27) Improper access control (CVE-ID: CVE-2025-24426)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and gain access to sensitive information.
28) Improper access control (CVE-ID: CVE-2025-24427)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.
29) Improper access control (CVE-ID: CVE-2025-24429)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and gain unauthorized access to sensitive information.
30) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2025-24430)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a race condition. A remote non-authenticated attacker can bypass implemented security restrictions and gain unauthorized access to the application.
31) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2025-24432)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a race condition. A remote non-authenticated attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Remediation
Install update from vendor's website.