CVE-2023-29294: Magento Community Edition Business Logic Errors Vulnerability
Summary
CVE-2023-29294: Magento Open Source has Business Logic Errors Vulnerability. Affects magento/community-edition across 2 version ranges.
>= 2.4.4-p1, < 2.4.4-p4
>= 2.4.5-p1, < 2.4.5-p3
Fixed in 2.4.4-p4 or 2.4.5-p3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Community Edition is an open-source e-commerce platform that provides a flexible shopping cart system, powerful marketing tools, and a customizable interface. It is widely used by businesses to create online stores. However, certain versions of Magento are susceptible to a Business Logic Errors vulnerability, which could allow low-privileged attackers to bypass security features, potentially compromising the integrity of the application.
Vulnerability Detail
Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier are affected by a Business Logic Errors vulnerability. This vulnerability arises from improper handling of security features, allowing low-privileged attackers to exploit the flaw without requiring user interaction. The ramifications include unauthorized access to functionalities that should be restricted, which could lead to further exploitation or data exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p42.4.4-p4composer require magento/community-edition:2.4.4-p4 -
>= 2.4.5-p1, < 2.4.5-p32.4.5-p3composer require magento/community-edition:2.4.5-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider restricting access to sensitive functionalities for low-privileged users until the patch is applied. This can be done by modifying user roles and permissions within the Magento admin panel.
Conclusion
The Business Logic Errors vulnerability in Magento Community Edition poses a risk of security feature bypass for low-privileged attackers. It is crucial to update to the latest patched versions to mitigate this risk and ensure the integrity of your e-commerce platform.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a low severity level.
The affected versions include Adobe Commerce 2.4.6 and earlier, 2.4.5-p2 and earlier, and 2.4.4-p3 and earlier.
No, exploitation of this vulnerability does not require user interaction.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing stricter access controls and monitoring for any suspicious activity until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
