Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.
Severity
Medium 6.5
Published
11 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.4.4
Sources
NVD
Affected software
Software
Affected versions
Magento / Adobe CommerceServers and applications · cpe:a:adobe:commerce
Version 2.4.8-beta1
Version 2.4.7-p3
Version 2.4.7-p2
Version 2.4.7-p1
All 38 release lines
Every version before 2.4.4
Version 2.4.4
Version 2.4.4-p1
Version 2.4.4-p2
Version 2.4.4-p3
Version 2.4.4-p4
Version 2.4.4-p5
Version 2.4.4-p6
Version 2.4.4-p7
Version 2.4.4-p8
Version 2.4.4-p9
Version 2.4.4-p10
Version 2.4.4-p11
Version 2.4.5
Version 2.4.5-p1
Version 2.4.5-p2
Version 2.4.5-p3
Version 2.4.5-p4
Version 2.4.5-p5
Version 2.4.5-p6
Version 2.4.5-p7
Version 2.4.5-p8
Version 2.4.5-p9
Version 2.4.5-p10
Version 2.4.6
Version 2.4.6-p1
Version 2.4.6-p2
Version 2.4.6-p3
Version 2.4.6-p4
Version 2.4.6-p5
Version 2.4.6-p6
Version 2.4.6-p7
Version 2.4.6-p8
Version 2.4.7
Version 2.4.7-p1
Version 2.4.7-p2
Version 2.4.7-p3
Version 2.4.8-beta1
Magento / Adobe CommerceServers and applications · cpe:a:adobe:magento