{"id":13405,"date":"2022-02-15T10:38:59","date_gmt":"2022-02-15T10:38:59","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/15\/critical-vulnerability-strikes-magento-open-source-and-adobe-commerce\/"},"modified":"2022-02-15T10:38:59","modified_gmt":"2022-02-15T10:38:59","slug":"critical-vulnerability-strikes-magento-open-source-and-adobe-commerce","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/15\/critical-vulnerability-strikes-magento-open-source-and-adobe-commerce\/","title":{"rendered":"Critical Vulnerability Strikes Magento Open Source and Adobe Commerce"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Adobe announced a critical vulnerability affecting Adobe Commerce and Magento Open Source. Adobe Commerce merchants have been attacked and the exploitation of the vulnerability is in the wild right now.<\/p>\n

An important detail of the vulnerability that Adobe shared is that no authentication is necessary in order to successfully execute a successful exploitation.<\/p>\n

That means that an attacker doesn\u2019t need to acquire a user login privilege in order to exploit the vulnerability.<\/p>\n

The second detail about this exploit that Adobe shared is that admin privileges are not necessary for exploiting this vulnerability.\n<\/p>\n

Adobe Vulnerability Ratings<\/h2>\n

Adobe published three rating metrics for vulnerabilities:<\/strong><\/p>\n

    \n
  1. Common Vulnerability Scoring System (CVSS)<\/li>\n
  2. Priority<\/li>\n
  3. Vulnerability Level<\/li>\n<\/ol>\n

    Common Vulnerability Scoring System (CVSS)<\/h3>\n

    The Common Vulnerability Scoring System (CVSS) is an open standard developed by a non-profit (First.org<\/a>) that is based on a scale of 1 to 10 to score vulnerabilities.<\/p>\n

    A score of one is the least concerning and a score of ten is the highest level of severity of a vulnerability.<\/p>\n

    The CVSS score for the Adobe Commerce and Magento vulnerability is 9.8.<\/strong><\/p>\n

    Vulnerability Priority Level<\/h3>\n

    The priority metric has three levels, 1, 2, and 3. Level 1 is the most serious and level three is the least serious.<\/p>\n

    Adobe has listed the priority level of this exploit as 1, which is the highest level.<\/p>\n

    Level 1 priority level means that the the vulnerabilities are being actively exploited in websites.<\/p>\n

    This is the worst-case scenario for merchants because it means that unpatched instances of Adobe Commerce and Magento are vulnerable to being hacked.<\/p>\n

    Adobe\u2019s definition of Priority Level 1 is:<\/strong><\/p>\n

    \n

    \u201cThis update resolves vulnerabilities being targeted, or which have a higher risk of being targeted, by exploit(s) in the wild for a given product version and platform.<\/p>\n

    Adobe recommends administrators install the update as soon as possible. (for example, within 72 hours).\u201d<\/p>\n<\/blockquote>\n

    Vulnerability Level<\/h3>\n

    Adobe\u2019s vulnerability levels are named moderate, important and critical, with critical representing the most dangerous level.<\/p>\n

    The vulnerability level assigned to the Adobe Commerce and Magento Open source exploit is rated as critical, which is the most dangerous rating level.<\/p>\n

    Adobe\u2019s definition<\/a> of the critical rating level is:<\/strong><\/p>\n

    \n

    \u201cA vulnerability, which, if exploited would allow malicious native-code to execute, potentially without a user being aware.\u201d<\/p>\n<\/blockquote>\n

    Arbitrary Code Execution Exploit<\/h2>\n

    What makes this vulnerability especially worrying is the fact that Adobe admitted it\u2019s an Arbitrary Code Execution vulnerability.<\/p>\n

    Arbitrary code execution generally means that the kind of code that can be run by an attacker is not limited in scope but is wide open to essentially any code they want in order to execute nearly whatever task or command they wish.<\/p>\n

    An arbitrary code execution vulnerability is a highly serious type of attack.<\/p>\n

    Which Versions Are Affected<\/h2>\n

    Adobe announced that an update patch was published to fix the affected versions of its software.<\/p>\n

    The update release notes<\/a> stated:<\/p>\n

    \n

    \u201cThe patches were tested to resolve the issue for all versions from 2.3.3-p1 to 2.3.7-p2 and from 2.4.0 to 2.4.3-p1.\u201d<\/p>\n<\/blockquote>\n

    The main vulnerability announcement stated that Adobe Commerce versions 2.3.3 and lower are not affected.https:\/\/helpx.adobe.com\/security\/products\/magento\/apsb22-12.html<\/p>\n

    Adobe recommends that users of the affected software update their installations immediately.<\/p>\n

    Citations<\/h2>\n

    Read the Adobe Security Bulletin<\/h3>\n

    Security\u202fupdate\u202favailable\u202ffor\u202fAdobe Commerce\u202f|\u202fAPSB22-12<\/a><\/p>\n

    Read the Adobe Commerce and Magento Open Source Patch Release Notes<\/h3>\n

    Security updates available for Adobe Commerce APSB22-12<\/a><\/p>\n

    Information About Exploit Severity Ratings<\/h3>\n

    Adobe Severity Ratings<\/a><\/p>\n<\/div>\n