Every CVE Search/ Get API key

CVE-2024-34103

Customer account takeover via web API call & subsequent password reset

8.1 HighFix available

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.91%Up 0.8 points since Jun 14, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.1

Customer account takeover via web API call & subsequent password reset

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Record
CVE-2024-34103
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2024-2037 8.1

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Record
EUVD-2024-2037
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-f7q4-9gwv-6774 9.2

Magento Open Source Improper Authentication vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Record
GHSA-f7q4-9gwv-6774
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
NVD 8.1

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Record
CVE-2024-34103
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSV 8.1

Customer account takeover via web API call & subsequent password reset

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Record
CVE-2024-34103
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVGHSA-f7q4-9gwv-6774 9.2

Magento Open Source Improper Authentication vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Record
GHSA-f7q4-9gwv-6774
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVBIT-magento-2024-34103 No score

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

Record
BIT-magento-2024-34103
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
magento/community-edition
Packagist
2.4.7 to 2.4.7 None known
magento/community-edition
Packagist
2.4.6 to 2.4.6 None known
magento/community-edition
Packagist
2.4.5 to 2.4.5 None known
magento/community-edition
Packagist
2.4.4 to 2.4.4 None known
magento/community-edition
Packagist
2.4.6-p1 up to 2.4.6-p6
2.4.6-p6
magento/community-edition
Packagist
2.4.5-p1 up to 2.4.5-p8
2.4.5-p8
magento/community-edition
Packagist
before 2.4.4-p9
2.4.4-p9
magento
Bitnami
2.4.7-alpha0 up to 2.4.7-p1, 2.4.6-alpha0 up to 2.4.6-p6, 2.4.5-alpha0 up to 2.4.5-p8, 2.4.4-alpha0 up to 2.4.4-p9
2.4.7-p12.4.6-p62.4.5-p82.4.4-p9
magento/community-edition
Packagist
Listed versions
2.4.7
None known
magento/community-edition
Packagist
Listed versions
2.4.6
None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
magento/community-edition
Packagist
Listed versions
2.4.5
None known
magento/community-edition
Packagist
Listed versions
2.4.4
None known
magento/community-edition
Packagist
2.4.6-p1 up to 2.4.6-p6, plus listed versions
2.4.6-p22.4.6-p32.4.6-p42.4.6-p5
2.4.6-p6
magento/community-edition
Packagist
2.4.5-p1 up to 2.4.5-p8, plus listed versions
2.4.5-p22.4.5-p32.4.5-p42.4.5-p52.4.5-p62.4.5-p7
2.4.5-p8
magento/community-edition
Packagist
before 2.4.4-p9, plus listed versions
0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104
Show 45 moreShow less
0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3
2.4.4-p9

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34103 is a high vulnerability (CVSS 8.1) in Adobe Commerce, published June 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in magento/community-edition 2.4.6-p6.

References

This page doesn't list everything

Left out here: 96 versions. The JSON record has them.

MoveEnter Open