Drupal Commerce Core Vulnerability Exploited Against Online Stores
Summary
Drupal has reported a critical vulnerability in its Commerce Core module that allows for access bypass, and this vulnerability is actively being exploited in the wild. The company is urging online store owners who use the module to audit their orders for any signs of compromise.
IFF Assessment
This vulnerability allows unauthorized access bypass, which is detrimental to the security of online stores.
Severity
The CVSS score is estimated as high (9.8) due to the critical nature of the 'access bypass' vulnerability, indicating it can be exploited remotely without authentication and has a significant impact on confidentiality, integrity, and availability for online stores.
Defender Context
This article highlights a critical vulnerability in Drupal Commerce Core that is already being exploited, posing an immediate threat to online stores. Defenders should prioritize patching or implementing mitigation strategies for Drupal Commerce Core and remain vigilant for signs of unauthorized access or order manipulation.