CVE-2022-35689: Magento Community Edition Improper Access Control Vulnerability
Summary
CVE-2022-35689: Magento Open Source allows Improper Access Control. Affects magento/community-edition across 2 version ranges.
>= 2.4.3-p1, <= 2.4.3-p3
>= 2.4.4-p1, < 2.4.4-p2
Fixed in 2.4.4-p2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Community Edition is a widely used open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento are vulnerable to an improper access control issue, which can lead to security feature bypass and affect the availability of specific user features.
Vulnerability Detail
Adobe Commerce versions 2.4.3-p3 (and earlier), 2.4.4-p1 (and earlier), and 2.4.5 (and earlier) are affected by an improper access control vulnerability. This flaw allows attackers to bypass security features without requiring user interaction, potentially impacting the availability of minor features for users. The vulnerability is classified under CWE-284, indicating a failure to enforce proper access controls.
How To Fix
Minimum fixed version
2.4.4-p2
This is the first release that contains the fix.
composer require magento/community-edition:2.4.4-p2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected features manually until the patch is applied. This may involve adjusting user roles and permissions within the Magento admin panel to limit access to sensitive functionalities.
Conclusion
The improper access control vulnerability in Magento Community Edition poses a risk to users by allowing potential security feature bypass. It is crucial to update to the latest patched version to mitigate this risk. Additionally, users can utilize Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2022-35689 is a vulnerability in Magento Community Edition that allows improper access control, potentially leading to security feature bypass.
Affected versions include Magento Community Edition 2.4.3-p3 and earlier, 2.4.4-p1 and earlier, and 2.4.5 and earlier.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update immediately, consider implementing manual access restrictions to limit exposure to the vulnerability until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
