CVE-2023-38218: Magento Community Edition Incorrect Authorization Vulnerability
Summary
CVE-2023-38218: Magento Open Source allows Incorrect Authorization. Affects magento/community-edition across 4 version ranges.
>= 2.4.4-p1, < 2.4.4-p6
>= 2.4.5-p1, < 2.4.5-p5
>= 2.4.6-p1, < 2.4.6-p3
>= 2.4.7-beta1, < 2.4.7-beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Community Edition is a widely-used open-source eCommerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento are susceptible to an improper input validation vulnerability that can lead to unauthorized access to sensitive customer information.
Vulnerability Detail
The vulnerability arises from improper input validation in the V1/customers/me endpoint, allowing an authenticated attacker to exploit an insecure direct object reference. This can lead to information exposure and privilege escalation, potentially compromising customer data and administrative controls. The affected versions include Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p62.4.4-p6composer require magento/community-edition:2.4.4-p6 -
>= 2.4.5-p1, < 2.4.5-p52.4.5-p5composer require magento/community-edition:2.4.5-p5 -
>= 2.4.6-p1, < 2.4.6-p32.4.6-p3composer require magento/community-edition:2.4.6-p3 -
>= 2.4.7-beta1, < 2.4.7-beta22.4.7-beta2composer require magento/community-edition:2.4.7-beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict access to the V1/customers/me endpoint until the patch can be applied. This can be done by modifying the server configuration to deny requests to this endpoint for unauthorized users.
Conclusion
In summary, CVE-2023-38218 is a significant vulnerability affecting multiple versions of Magento Community Edition, allowing unauthorized access to sensitive information. It is crucial for users to update their installations to the latest patched versions to mitigate this risk.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-38218 is a vulnerability in Magento Community Edition that allows for incorrect authorization, leading to potential information exposure and privilege escalation.
Affected versions include 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To secure your installation, update to the latest patched version of Magento and consider restricting access to sensitive endpoints until the update is applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
