Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing security mechanisms. Exploitation of this issue requires user interaction.
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Commerce | Adobe | * | 2.4.4 (excluding) |
| Commerce | Adobe | 2.4.4 (including) | 2.4.4 (including) |
| Commerce | Adobe | 2.4.4-p1 (including) | 2.4.4-p1 (including) |
| Commerce | Adobe | 2.4.4-p10 (including) | 2.4.4-p10 (including) |
| Commerce | Adobe | 2.4.4-p11 (including) | 2.4.4-p11 (including) |
| Commerce | Adobe | 2.4.4-p2 (including) | 2.4.4-p2 (including) |
| Commerce | Adobe | 2.4.4-p3 (including) | 2.4.4-p3 (including) |
| Commerce | Adobe | 2.4.4-p4 (including) | 2.4.4-p4 (including) |
| Commerce | Adobe | 2.4.4-p5 (including) | 2.4.4-p5 (including) |
| Commerce | Adobe | 2.4.4-p6 (including) | 2.4.4-p6 (including) |
| Commerce | Adobe | 2.4.4-p7 (including) | 2.4.4-p7 (including) |
| Commerce | Adobe | 2.4.4-p8 (including) | 2.4.4-p8 (including) |
| Commerce | Adobe | 2.4.4-p9 (including) | 2.4.4-p9 (including) |
| Commerce | Adobe | 2.4.5 (including) | 2.4.5 (including) |
| Commerce | Adobe | 2.4.5-p1 (including) | 2.4.5-p1 (including) |
| Commerce | Adobe | 2.4.5-p10 (including) | 2.4.5-p10 (including) |
| Commerce | Adobe | 2.4.5-p2 (including) | 2.4.5-p2 (including) |
| Commerce | Adobe | 2.4.5-p3 (including) | 2.4.5-p3 (including) |
| Commerce | Adobe | 2.4.5-p4 (including) | 2.4.5-p4 (including) |
| Commerce | Adobe | 2.4.5-p5 (including) | 2.4.5-p5 (including) |
| Commerce | Adobe | 2.4.5-p6 (including) | 2.4.5-p6 (including) |
| Commerce | Adobe | 2.4.5-p7 (including) | 2.4.5-p7 (including) |
| Commerce | Adobe | 2.4.5-p8 (including) | 2.4.5-p8 (including) |
| Commerce | Adobe | 2.4.5-p9 (including) | 2.4.5-p9 (including) |
| Commerce | Adobe | 2.4.6 (including) | 2.4.6 (including) |
| Commerce | Adobe | 2.4.6-p1 (including) | 2.4.6-p1 (including) |
| Commerce | Adobe | 2.4.6-p2 (including) | 2.4.6-p2 (including) |
| Commerce | Adobe | 2.4.6-p3 (including) | 2.4.6-p3 (including) |
| Commerce | Adobe | 2.4.6-p4 (including) | 2.4.6-p4 (including) |
| Commerce | Adobe | 2.4.6-p5 (including) | 2.4.6-p5 (including) |
| Commerce | Adobe | 2.4.6-p6 (including) | 2.4.6-p6 (including) |
| Commerce | Adobe | 2.4.6-p7 (including) | 2.4.6-p7 (including) |
| Commerce | Adobe | 2.4.6-p8 (including) | 2.4.6-p8 (including) |
| Commerce | Adobe | 2.4.7 (including) | 2.4.7 (including) |
| Commerce | Adobe | 2.4.7-p1 (including) | 2.4.7-p1 (including) |
| Commerce | Adobe | 2.4.7-p2 (including) | 2.4.7-p2 (including) |
| Commerce | Adobe | 2.4.7-p3 (including) | 2.4.7-p3 (including) |
| Commerce | Adobe | 2.4.8-beta1 (including) | 2.4.8-beta1 (including) |