GHSA-85m4-g9vq-xpxj
Magento Open Source allows Information Exposure
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | magento/community-edition | 2.4.6 | no fix listed |
| Packagist | magento/community-edition | 2.4.5 | no fix listed |
| Packagist | magento/community-edition | 2.4.4 | no fix listed |
| Packagist | magento/community-edition | >= 2.4.5-p1, < 2.4.5-p3 | 2.4.5-p3 |
| Packagist | magento/community-edition | >= 2.4.4-p1, < 2.4.4-p4 | 2.4.4-p4 |
| Packagist | magento/project-community-edition | <= 2.0.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. An attacker could leverage this vulnerability to leak minor user data. Exploitation of this issue does not require user interaction..
References
External links from the advisory. They lead to third-party sites.