CVE-2024-49521highCWE-918

CVE-2024-49521: high-severity vulnerability in Adobe Commerce

Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Published

Follow this CVE+ Monitor Adobe Commerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.7%
Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Adobe · Adobe Commerce
Related CVEs — Adobe Commerce

In the same product, most dangerous first.

CVE-2024-34102CRITICALXXE can expose crypt key and other secrets granting full admin accessEPSS 100.0%KEVCVE-2026-75650CRITICALAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)EPSS 99.4%KEVCVE-2025-54236CRITICALAdobe Commerce | Improper Input Validation (CWE-20)EPSS 95.4%KEVCVE-2026-71362CRITICALAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 90.5%KEVCVE-2026-48356CRITICALAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)EPSS 47.5%CVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 21.4%