Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability by manipulating the timing between the check of a resources state and its use, allowing unauthorized write access. Exploitation of this issue does not require user interaction.
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Commerce | Adobe | * | 2.4.4 (excluding) |
| Commerce | Adobe | 2.4.4 (including) | 2.4.4 (including) |
| Commerce | Adobe | 2.4.4-p1 (including) | 2.4.4-p1 (including) |
| Commerce | Adobe | 2.4.4-p10 (including) | 2.4.4-p10 (including) |
| Commerce | Adobe | 2.4.4-p11 (including) | 2.4.4-p11 (including) |
| Commerce | Adobe | 2.4.4-p12 (including) | 2.4.4-p12 (including) |
| Commerce | Adobe | 2.4.4-p13 (including) | 2.4.4-p13 (including) |
| Commerce | Adobe | 2.4.4-p14 (including) | 2.4.4-p14 (including) |
| Commerce | Adobe | 2.4.4-p2 (including) | 2.4.4-p2 (including) |
| Commerce | Adobe | 2.4.4-p3 (including) | 2.4.4-p3 (including) |
| Commerce | Adobe | 2.4.4-p4 (including) | 2.4.4-p4 (including) |
| Commerce | Adobe | 2.4.4-p5 (including) | 2.4.4-p5 (including) |
| Commerce | Adobe | 2.4.4-p6 (including) | 2.4.4-p6 (including) |
| Commerce | Adobe | 2.4.4-p7 (including) | 2.4.4-p7 (including) |
| Commerce | Adobe | 2.4.4-p8 (including) | 2.4.4-p8 (including) |
| Commerce | Adobe | 2.4.4-p9 (including) | 2.4.4-p9 (including) |
| Commerce | Adobe | 2.4.5 (including) | 2.4.5 (including) |
| Commerce | Adobe | 2.4.5-p1 (including) | 2.4.5-p1 (including) |
| Commerce | Adobe | 2.4.5-p10 (including) | 2.4.5-p10 (including) |
| Commerce | Adobe | 2.4.5-p11 (including) | 2.4.5-p11 (including) |
| Commerce | Adobe | 2.4.5-p12 (including) | 2.4.5-p12 (including) |
| Commerce | Adobe | 2.4.5-p13 (including) | 2.4.5-p13 (including) |
| Commerce | Adobe | 2.4.5-p2 (including) | 2.4.5-p2 (including) |
| Commerce | Adobe | 2.4.5-p3 (including) | 2.4.5-p3 (including) |
| Commerce | Adobe | 2.4.5-p4 (including) | 2.4.5-p4 (including) |
| Commerce | Adobe | 2.4.5-p5 (including) | 2.4.5-p5 (including) |
| Commerce | Adobe | 2.4.5-p6 (including) | 2.4.5-p6 (including) |
| Commerce | Adobe | 2.4.5-p7 (including) | 2.4.5-p7 (including) |
| Commerce | Adobe | 2.4.5-p8 (including) | 2.4.5-p8 (including) |
| Commerce | Adobe | 2.4.5-p9 (including) | 2.4.5-p9 (including) |
| Commerce | Adobe | 2.4.6 (including) | 2.4.6 (including) |
| Commerce | Adobe | 2.4.6-p1 (including) | 2.4.6-p1 (including) |
| Commerce | Adobe | 2.4.6-p10 (including) | 2.4.6-p10 (including) |
| Commerce | Adobe | 2.4.6-p11 (including) | 2.4.6-p11 (including) |
| Commerce | Adobe | 2.4.6-p2 (including) | 2.4.6-p2 (including) |
| Commerce | Adobe | 2.4.6-p3 (including) | 2.4.6-p3 (including) |
| Commerce | Adobe | 2.4.6-p4 (including) | 2.4.6-p4 (including) |
| Commerce | Adobe | 2.4.6-p5 (including) | 2.4.6-p5 (including) |
| Commerce | Adobe | 2.4.6-p6 (including) | 2.4.6-p6 (including) |
| Commerce | Adobe | 2.4.6-p7 (including) | 2.4.6-p7 (including) |
| Commerce | Adobe | 2.4.6-p8 (including) | 2.4.6-p8 (including) |
| Commerce | Adobe | 2.4.6-p9 (including) | 2.4.6-p9 (including) |
| Commerce | Adobe | 2.4.7 (including) | 2.4.7 (including) |
| Commerce | Adobe | 2.4.7-b1 (including) | 2.4.7-b1 (including) |
| Commerce | Adobe | 2.4.7-b2 (including) | 2.4.7-b2 (including) |
| Commerce | Adobe | 2.4.7-beta3 (including) | 2.4.7-beta3 (including) |
| Commerce | Adobe | 2.4.7-p1 (including) | 2.4.7-p1 (including) |
| Commerce | Adobe | 2.4.7-p2 (including) | 2.4.7-p2 (including) |
| Commerce | Adobe | 2.4.7-p3 (including) | 2.4.7-p3 (including) |
| Commerce | Adobe | 2.4.7-p4 (including) | 2.4.7-p4 (including) |
| Commerce | Adobe | 2.4.7-p5 (including) | 2.4.7-p5 (including) |
| Commerce | Adobe | 2.4.7-p6 (including) | 2.4.7-p6 (including) |
| Commerce | Adobe | 2.4.8 (including) | 2.4.8 (including) |
| Commerce | Adobe | 2.4.8-beta1 (including) | 2.4.8-beta1 (including) |