CVE-2025-49555

描述

Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim into executing unintended actions on a web application where the victim is authenticated, potentially allowing unauthorized access or modification of sensitive data. Exploitation of this issue requires user interaction in that a victim must visit a malicious website or click on a crafted link. Scope is changed.

受影響套件(2)

• Packagist/magento/community-edition>= 2.4.9-alpha1, < 2.4.9-alpha2
• Packagist/magento/project-community-editionfrom 0, <= 2.0.2

CVSS 分數

參考連結(3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-49555
• PATCHhttps://github.com/magento/magento2
• WEBhttps://helpx.adobe.com/security/products/magento/apsb25-71.html