CVE-2023-22251: Magento Community Edition Incorrect Authorization Vulnerability
Summary
CVE-2023-22251: Magento Open Source allows Incorrect Authorization. Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.4-p3
>= 2.4.5-p1, < 2.4.5-p2
Fixed in 2.4.4-p3 or 2.4.5-p2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Community Edition is an open-source e-commerce platform that provides businesses with the tools to create and manage online stores. It offers a wide range of features, including product management, customer management, and various payment options. However, certain versions of Magento are susceptible to an Incorrect Authorization vulnerability, which can lead to unauthorized access to sensitive information.
Vulnerability Detail
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. This issue arises from improper authorization checks, allowing low-privileged authenticated attackers to exploit the vulnerability and gain access to minor information that should be restricted. The potential ramifications include unauthorized information disclosure, which could compromise user data and the integrity of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p32.4.4-p3composer require magento/community-edition:2.4.4-p3 -
>= 2.4.5-p1, < 2.4.5-p22.4.5-p2composer require magento/community-edition:2.4.5-p2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to sensitive areas of the application until the patch is applied. This can be done by modifying user roles and permissions to limit access for low-privileged users.
Conclusion
The Incorrect Authorization vulnerability in Magento Community Edition poses a risk of unauthorized information disclosure. It is crucial for users to update to the patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-22251 is a vulnerability in Magento Community Edition that allows low-privileged authenticated users to gain unauthorized access to restricted information.
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by this vulnerability.
The main risk is unauthorized information disclosure, which could lead to compromised user data and affect the integrity of the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
