Threats tagged 'ghsa-gvgf-pvh5-vjh4'

Magento project community edition versions up to and including certain patch levels of 2.4.7, 2.4.6, 2.4.5, and 2.4.4, as well as versions <=2.0.2, contain an improper authorization vulnerability (CVE-2024-39418). This flaw allows a low-privileged attacker to bypass security controls and view or edit low-sensitivity information without requiring user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.4. Fixed versions have been released for all affected branches.