CVE-2024-39408

mediumpriority · track · 17EPSS 0.005 · 42 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.49% (42nd) EPSS

CVSS 4.3 · medium

Is it mine?

28 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · ncsc_nl

EPSS · scored 2026-10-27

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changeson behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 1.4

v3.14.3mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · psirt@adobe.comexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · OSV

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-352USCWE-352USCWE-352USCWE-352US

affected products (28)

Products and version ranges known to be affected.

Adobe Adobe Commerce≤ 0 ≤2.4.4-p9enisa_euvdEU
Adobe Systems Inc. Adobe Commerce≤ 2.4.4-p9fstec_bduRU
Adobe Systems Inc. Adobe Commerce2.4.5 → 2.4.5-p8fstec_bduRU
Adobe Systems Inc. Adobe Commerce2.4.6 → 2.4.6-p6fstec_bduRU
Adobe Systems Inc. Adobe Commerce2.4.7 → 2.4.7-p1fstec_bduRU
Adobe Systems Inc. Magento Open Source≤ 2.4.4-p9fstec_bduRU
Adobe Systems Inc. Magento Open Source2.4.5 → 2.4.5-p8fstec_bduRU
Adobe Systems Inc. Magento Open Source2.4.6 → 2.4.6-p6fstec_bduRU
Adobe Systems Inc. Magento Open Source2.4.7 → 2.4.7-p1fstec_bduRU
adobe_commerceall versionsncsc_nlNLcpe:2.3:a:adobe:adobe_commerce:2.4.4-p9:*:*:*:*:*:*:*
adobe_commerceall versionsncsc_nlNLcpe:2.3:a:adobe:adobe_commerce:0:*:*:*:*:*:*:*
adobe adobe commerceall versionsncsc_nlNLcpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobe magento open sourceall versionsncsc_nlNLcpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
adobe commerce≤ 2.4.3nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.4nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.5nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.6nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe commerce= 2.4.7nvdUScpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
adobe magento≤ 2.4.3nvdUScpe:2.3:a:adobe:magento:*:*:*:*:*:*:*:*
adobe magento= 2.4.4nvdUScpe:2.3:a:adobe:magento:*:*:*:*:*:*:*:*

showing 20 of 28

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2024-0348Kwetsbaarheden verholpen in Adobe Commerce en MagentoNL2024-08-14csaf · ncsc_nlNL
Adobe heeft kwetsbaarheden verholpen in Commerce en Magento.
WID-SEC-W-2024-1840Adobe Magento: Mehrere SchwachstellenDeutsch2024-08-13csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um seine Rechte zu erweitern, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen oder vertrauliche Informationen offenzulegen.
GHSA-4cj6-f32v-6hgxMagento Open Source Cross-Site Request Forgery vulnerability2024-08-14ghsa · osvUS
Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu ncsc_nl nvd cert_bund osv NVD CVE.org MITRE

published 2024-08-14modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan