Information disclosure in Adobe products - CVE-2025-24408

Vulnerability identifier: #VU103853

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-24408

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can gain unauthorized access to sensitive information on the system.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install updates from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-p12, 1.3.4-p11, 1.3.5-p9, 1.4.2-p4, 1.5.1
Magento Open Source - addressed in versions 2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-beta2, 2.4.7-p4
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-beta2, 2.4.7-p4

• https://helpx.adobe.com/security/products/magento/apsb25-08.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source