CVE-2023-29288: Magento Community Edition Incorrect Authorization Vulnerability
Summary
CVE-2023-29288: Magento Open Source allows Incorrect Authorization. Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.4-p4
>= 2.4.5-p1, < 2.4.5-p3
Fixed in 2.4.4-p4 or 2.4.5-p3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Community Edition are susceptible to an Incorrect Authorization vulnerability, which can compromise user data integrity.
Vulnerability Detail
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability. This flaw allows a privileged attacker to bypass security features and modify minor functionalities of another user's data without requiring user interaction. The vulnerability stems from improper authorization checks, which can lead to unauthorized access and manipulation of user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p42.4.4-p4composer require magento/community-edition:2.4.4-p4 -
>= 2.4.5-p1, < 2.4.5-p32.4.5-p3composer require magento/community-edition:2.4.5-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to sensitive functionalities by implementing additional authorization checks in your application code until the patch is applied.
Conclusion
The Incorrect Authorization vulnerability in Magento Community Edition poses a risk to user data integrity. It is crucial to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Affected versions include Adobe Commerce 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier.
No, exploitation of this vulnerability does not require user interaction.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
If immediate updating is not possible, consider implementing additional authorization checks as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
