CVE-2023-26367: Magento Community Edition Improper Input Validation Vulnerability
Summary
CVE-2023-26367: Magento Open Source has Improper Input Validation Vulnerability. Affects magento/community-edition across 4 version ranges.
>= 2.4.4-p1, < 2.4.4-p6
>= 2.4.5-p1, < 2.4.5-p5
>= 2.4.6-p1, < 2.4.6-p3
>= 2.4.7-beta1, < 2.4.7-beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a leading open-source e-commerce platform that provides businesses with a flexible shopping cart system, control over the look and feel of their online store, and a wide range of features to enhance customer experience. The platform is widely used for building and managing online stores, making it a critical component for many businesses. However, certain versions of Magento Community Edition are vulnerable to an improper input validation issue, which can compromise the security of the application.
Vulnerability Detail
The vulnerability identified as CVE-2023-26367 arises from improper input validation in Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier. This flaw allows an authenticated attacker with admin privileges to read arbitrary files from the file system without requiring user interaction. The potential ramifications include unauthorized access to sensitive information, which could lead to further exploitation of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p62.4.4-p6composer require magento/community-edition:2.4.4-p6 -
>= 2.4.5-p1, < 2.4.5-p52.4.5-p5composer require magento/community-edition:2.4.5-p5 -
>= 2.4.6-p1, < 2.4.6-p32.4.6-p3composer require magento/community-edition:2.4.6-p3 -
>= 2.4.7-beta1, < 2.4.7-beta22.4.7-beta2composer require magento/community-edition:2.4.7-beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict access to the admin panel and monitor file access logs for any suspicious activity until the patch can be applied.
Conclusion
The improper input validation vulnerability in Magento Community Edition poses a significant risk to users of affected versions. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your e-commerce platform.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-26367 is an improper input validation vulnerability in certain versions of Magento Community Edition that allows authenticated attackers to read arbitrary files from the file system.
Affected versions include Magento Community Edition 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information, potentially compromising the entire system.
If immediate updates are not possible, restrict access to the admin panel and monitor logs for any suspicious activity as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
