CVE-2025-27189

Description

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.

Reserved 2025-02-19 | Published 2025-04-08 | Updated 2025-04-08 | Assigner adobe

Problem types

Cross-Site Request Forgery (CSRF) (CWE-352)

Product status

Default status
affected

Any version
affected

References

helpx.adobe.com/security/products/magento/apsb25-26.html vendor-advisory

cve.org (CVE-2025-27189)

nvd.nist.gov (CVE-2025-27189)

Download JSON