CVE-2025-49555
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-12

Last updated on: 2025-08-15

Assigner: Adobe Systems Incorporated

Description
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim into executing unintended actions on a web application where the victim is authenticated, potentially allowing unauthorized access or modification of sensitive data. Exploitation of this issue requires user interaction in that a victim must visit a malicious website or click on a crafted link. Scope is changed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-12
Last Modified
2025-08-15
Generated
2026-05-07
AI Q&A
2025-08-12
EPSS Evaluated
2026-05-05
NVD
CVE-2025-49555
Affected Vendors & Products
Showing 148 associated CPEs
Vendor Product Version / Range
adobe commerce to 2.4.4 (exc)
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.8
adobe commerce 2.4.8
adobe commerce_b2b to 1.3.3 (exc)
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.3.5
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.5.3
adobe magento to 2.4.5 (exc)
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.5
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.8
adobe magento 2.4.8
adobe magento 2.4.8
adobe magento 2.4.9
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in Adobe Commerce versions up to 2.4.9-alpha1. It allows a high-privileged attacker to trick an authenticated user into performing unintended actions on the web application by visiting a malicious website or clicking a crafted link. This can lead to privilege escalation and unauthorized access or modification of sensitive data.


How can this vulnerability impact me? :

If exploited, this vulnerability can allow an attacker to escalate privileges by causing an authenticated user to unknowingly execute actions they did not intend. This could result in unauthorized access to or modification of sensitive data within the affected Adobe Commerce application.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart