CVE-2023-29290: Magento Community Edition Incorrect Authorization Vulnerability
Summary
CVE-2023-29290: Magento Open Source allows Incorrect Authorization. Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.4-p4
>= 2.4.5-p1, < 2.4.5-p3
Fixed in 2.4.4-p4 or 2.4.5-p3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a leading open-source e-commerce platform that provides businesses with the tools to create and manage online stores. It offers a wide range of features, including product management, customer management, and order processing. However, certain versions of Magento Community Edition are susceptible to an Incorrect Authorization vulnerability, which can lead to security feature bypasses.
Vulnerability Detail
The Incorrect Authorization vulnerability in Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier) allows attackers to bypass minor functionalities without requiring user interaction. This vulnerability stems from insufficient authorization checks, which can lead to unauthorized access to certain features or data within the application. The potential ramifications include unauthorized actions being performed by attackers, which could compromise the integrity of the e-commerce platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p42.4.4-p4composer require magento/community-edition:2.4.4-p4 -
>= 2.4.5-p1, < 2.4.5-p32.4.5-p3composer require magento/community-edition:2.4.5-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The Incorrect Authorization vulnerability in Magento Community Edition poses a risk to users by allowing unauthorized access to certain functionalities. It is crucial for users to update their installations to the latest patched versions to mitigate this risk and ensure the security of their e-commerce platforms.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-29290 is a vulnerability in Magento Community Edition that allows incorrect authorization, potentially leading to security feature bypass.
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier), and 2.4.4-p3 (and earlier) are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To secure your Magento installation, update to the latest patched version as soon as possible and regularly monitor for new vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
