CVE-2024-39398— OTP 2FA can be bruteforced
Quick assessment
Affected
Adobe Adobe Commerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Adobe Commerce是美国奥多比（Adobe）公司的一种面向商家和品牌的全球领先的数字商务解决方案。 Adobe Commerce存在安全漏洞，该漏洞源于没有限制身份验证尝试的次数。
Possible ATT&CK Techniques 1 AI
T1110.004 · Credential Stuffing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-39398
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OTP 2FA can be bruteforced
Source: CVE Program / CVE List V5
Vulnerability Description
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Adobe Commerce 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe Commerce是美国奥多比（Adobe）公司的一种面向商家和品牌的全球领先的数字商务解决方案。 Adobe Commerce存在安全漏洞，该漏洞源于没有限制身份验证尝试的次数。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Adobe Commerce | 0 ~ 2.4.4-p9 | - |
|
II. Public POCs for CVE-2024-39398
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-39398
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-39398 (1)
-
https://helpx.adobe.com/security/products/magento/apsb24-61.html vendor-advisory
Same Patch Batch · Adobe · 2024-08-14 · 74 CVEs total
| CVE-2024-39397 | 9.0 CRITICAL | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| CVE-2024-39402 | 8.4 HIGH | Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Co |
| CVE-2024-39401 | 8.4 HIGH | Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Co |
| CVE-2024-39400 | 8.1 HIGH | DOM XSS through integrations can impact other admins |
| CVE-2024-41840 | 7.8 HIGH | ZDI-CAN-24607: Adobe Bridge JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vul |
| CVE-2024-41865 | 7.8 HIGH | Adobe Dimension Untrusted Search Path lead to load malicious DLL swift.dll |
| CVE-2024-34117 | 7.8 HIGH | Adobe Photoshop 2024 MPO File Parsing Use-After-Free vulnerability |
| CVE-2024-41856 | 7.8 HIGH | Illustrator | Improper Input Validation (CWE-20) |
| CVE-2024-39426 | 7.8 HIGH | ZDI-CAN-24312: Adobe Acrobat Reader DC Annotation Memory Corruption Remote Code Execution |
| CVE-2024-34124 | 7.8 HIGH | ZDI-CAN-24031: Adobe Dimension SKP File Parsing Out-Of-Bounds Write Remote Code Execution |
| CVE-2024-41864 | 7.8 HIGH | Adobe Substance 3D Designer ICO Parsing Out-Of-Bounds Write Vulnerability |
| CVE-2024-41858 | 7.8 HIGH | Adobe InCopy has an integer overflow vulnerability when parsing SVG file |
| CVE-2024-20789 | 7.8 HIGH | ZDI-CAN-24030: Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulne |
| CVE-2024-39386 | 7.8 HIGH | ZDI-CAN-24057: Adobe Bridge AVI FIle Parsing Out-Of-Bounds Write Remote Code Execution Vul |
| CVE-2024-34133 | 7.8 HIGH | Adobe Illustrator CC 2023 v27.9 Vulnerability I |
| CVE-2024-39388 | 7.8 HIGH | ZDI-CAN-24055: Adobe Substance 3D Stager SKP File Parsing Use-After-Free Remote Code Execu |
| CVE-2024-39394 | 7.8 HIGH | Adobe Indesign 2024 PDF File Parsing Out Of Bound Write Remote Code Execution Vulnerabilit |
| CVE-2024-39393 | 7.8 HIGH | Adobe Indesign 2024 PCT File Parsing Memory Corruption Remote Code Execution Vulnerability |
| CVE-2024-39389 | 7.8 HIGH | Adobe Indesign PDF File Parsing Stack Based Buffer Overflow Remote Code Execution Vulnerab |
| CVE-2024-41851 | 7.8 HIGH | Adobe InDesign (Beta) has an integer overflow vulnerability when parsing SVG file |
Showing top 20 of 74 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Adobe Commerce
-
CVE-2026-95631
Adobe Commerce | Improper Input Validation (CWE-20) -
CVE-2026-92910
Adobe Commerce | Incorrect Authorization (CWE-863) -
CVE-2026-103849
Adobe Commerce | Improper Neutralization of Special Elements -
CVE-2026-91013
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) -
CVE-2026-92464
Adobe Commerce | Improper Input Validation (CWE-20)
Same vendor: Adobe
-
CVE-2026-100134
Acrobat for Edge | Out-of-bounds Write (CWE-787) -
CVE-2026-100132
Acrobat for Edge | Out-of-bounds Read (CWE-125) -
CVE-2026-100119
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-102501
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-100114
CAI Content Credentials | Improper Access Control (CWE-284)
Same weakness: CWE-307
-
CVE-2026-116007
YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification Sms -
CVE-2026-65825
OpenReception: one tenant's throttle row disables the PIN br -
CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Passwo -
CVE-2024-2323
Password Brute Force via Password History Validation in Mult -
CVE-2026-111874
OpenCATS Career Portal CareersUI.php processLogin excessive