CVE-2023-38220: Magento Open Source Improper Authorization Vulnerability
Summary
CVE-2023-38220: Magento Open Source allows Improper Authorization. Affects magento/community-edition across 4 version ranges.
>= 2.4.4-p1, < 2.4.4-p6
>= 2.4.5-p1, < 2.4.5-p5
>= 2.4.6-p1, < 2.4.6-p3
>= 2.4.7-beta1, < 2.4.7-beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento are vulnerable to an Improper Authorization issue, which could allow unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability identified as CVE-2023-38220 affects Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier. This Improper Authorization vulnerability can lead to a security feature bypass, enabling attackers to access unauthorized data without requiring user interaction. The root cause lies in the inadequate authorization checks within the affected versions, which can be exploited to gain access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p62.4.4-p6composer require magento/community-edition:2.4.4-p6 -
>= 2.4.5-p1, < 2.4.5-p52.4.5-p5composer require magento/community-edition:2.4.5-p5 -
>= 2.4.6-p1, < 2.4.6-p32.4.6-p3composer require magento/community-edition:2.4.6-p3 -
>= 2.4.7-beta1, < 2.4.7-beta22.4.7-beta2composer require magento/community-edition:2.4.7-beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive data by implementing additional access controls or by disabling certain features until the patch is applied. However, this is not a permanent solution and updating to the latest version is strongly recommended.
Conclusion
In summary, CVE-2023-38220 is a significant vulnerability affecting various versions of Magento Open Source, allowing unauthorized access to sensitive data. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their e-commerce platforms.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2023-38220 is a vulnerability in Magento Open Source that allows improper authorization, potentially leading to unauthorized access to sensitive data.
The affected versions include Magento 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 7.5, indicating a moderate level of severity.
If immediate updating is not possible, consider implementing additional access controls as a temporary workaround until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
