CVE-2022-34256: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability (CVE-2022-34256) that could result in privilege escalation. The vulnerability was discovered and reported to Adobe Systems Incorporated on June 21, 2022, and was publicly disclosed on August 16, 2022 (NVD, CVE).

The vulnerability is classified as an Improper Authorization issue (CWE-285) with a CVSS v3.1 base score of 9.8 (Critical) according to NVD, while Adobe Systems assigned it a score of 7.5 (High). The vulnerability can be exploited remotely with low attack complexity and requires no user interaction or privileges (NVD, Lansweeper).

If exploited, this vulnerability allows attackers to access other users' data and potentially escalate their privileges within the system. The vulnerability poses a significant risk as it does not require user interaction for exploitation (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to versions 2.3.7-p4, 2.4.3-p3, 2.4.4-p1, or 2.4.5 depending on their current installation (Lansweeper).