CVE-2024-20716: Magento Community Edition Uncontrolled Resource Consumption Vulnerability
Summary
CVE-2024-20716: Magento Open Source allows Uncontrolled Resource Consumption. Affects magento/community-edition across 3 version ranges.
>= 2.4.4-p1, < 2.4.4-p7
>= 2.4.5-p1, < 2.4.5-p6
>= 2.4.6-p1, < 2.4.6-p4
Fixed in 2.4.4-p7, 2.4.5-p6 or 2.4.6-p4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a leading open-source e-commerce platform that provides businesses with a flexible and scalable solution for online commerce. It offers a wide range of features including product management, customer management, and order processing. However, certain versions of Magento Community Edition are susceptible to vulnerabilities that can compromise application performance and availability.
Vulnerability Detail
The vulnerability identified as CVE-2024-20716 affects Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier. It is categorized as an Uncontrolled Resource Consumption vulnerability, which allows a high-privileged attacker to exhaust system resources. This can lead to application denial-of-service, causing the application to slow down or crash. The exploitation of this vulnerability does not require user interaction, making it particularly dangerous.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.4-p1, < 2.4.4-p72.4.4-p7composer require magento/community-edition:2.4.4-p7 -
>= 2.4.5-p1, < 2.4.5-p62.4.5-p6composer require magento/community-edition:2.4.5-p6 -
>= 2.4.6-p1, < 2.4.6-p42.4.6-p4composer require magento/community-edition:2.4.6-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on resource-intensive operations to mitigate the impact of potential exploitation. This can help control the resource consumption until the package is updated.
Conclusion
The CVE-2024-20716 vulnerability in Magento Community Edition poses a significant risk by allowing attackers to consume system resources uncontrollably. It is crucial for users to update their installations to the latest patched versions to protect against potential denial-of-service attacks.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-20716 is a vulnerability in Magento Community Edition that allows high-privileged attackers to exhaust system resources, leading to potential denial-of-service.
Affected versions include Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
If immediate updates are not possible, implement rate limiting on resource-intensive operations as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
