CVE-2023-22248: Magento Community Edition Improper Input Validation Vulnerability
Summary
CVE-2023-22248: Magento Open Source affected by Improper Input Validation. Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.5-p4
>= 2.4.5-p1, < 2.4.5-p3
Fixed in 2.4.5-p4 or 2.4.5-p3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely used open-source e-commerce platform that empowers businesses to create and manage online stores. It offers a robust set of features, including product management, customer management, and customizable themes. However, certain versions of Magento Community Edition are susceptible to an Incorrect Authorization vulnerability that could lead to unauthorized data access.
Vulnerability Detail
The vulnerability identified as CVE-2023-22248 affects Adobe Commerce versions 2.4.6 and earlier, as well as 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier. This issue arises from improper input validation, allowing attackers to bypass security features and potentially leak sensitive data belonging to other users. The exploitation of this vulnerability does not require any user interaction, making it particularly concerning for affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.5-p1, < 2.4.5-p32.4.5-p3composer require magento/community-edition:2.4.5-p3 -
>= 2.4.4-p1, < 2.4.5-p42.4.5-p4composer require magento/community-edition:2.4.5-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive data until the patch is applied. This may involve modifying access control settings or implementing additional authentication measures.
Conclusion
CVE-2023-22248 is a significant vulnerability in Magento Community Edition that poses a risk of unauthorized data access. Users are strongly advised to update to the latest patched versions to mitigate this risk. Temporary workarounds can be implemented, but the best course of action is to apply the necessary updates as soon as possible.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-22248 is a vulnerability in Magento Community Edition that allows attackers to bypass security features and access unauthorized user data.
Affected versions include Adobe Commerce 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a moderate severity level.
If immediate updates are not possible, consider implementing access restrictions or additional authentication measures as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
