Cross-site request forgery in Adobe products - CVE-2025-49555

Vulnerability identifier: #VU113911

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-49555

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-p15, 1.3.4-p14, 1.3.5-p12, 1.4.2-p7, 1.5.2-p2, 1.5.3 alpha2
Magento Open Source - addressed in versions 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9 alpha2
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9 alpha2

• https://helpx.adobe.com/security/products/magento/apsb25-71.html

• Multiple vulnerabilities in Adobe Commerce and Magento