CVE-2024-39406: Magento Community Edition Path Traversal Vulnerability
Summary
CVE-2024-39406: Magento Open Source Path Traversal vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p10
>= 2.4.5-p1, < 2.4.5-p9
>= 2.4.6-p1, < 2.4.6-p7
>= 2.4.7-p1, < 2.4.7-p2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides merchants with a flexible shopping cart system, control over the look and feel of their online store, and a range of features to manage their business. However, certain versions of Magento Community Edition have been found to be vulnerable to a path traversal issue, which could allow unauthorized access to sensitive files and directories.
Vulnerability Detail
The vulnerability in Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier stems from an improper limitation of a pathname to a restricted directory, known as a Path Traversal vulnerability. This flaw allows attackers to exploit the system to read arbitrary files from the file system, potentially exposing sensitive information without requiring user interaction. The vulnerability is classified under CWE-22 and has a CVSS score of 6.8, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p102.4.4-p10composer require magento/community-edition:2.4.4-p10 -
>= 2.4.5-p1, < 2.4.5-p92.4.5-p9composer require magento/community-edition:2.4.5-p9 -
>= 2.4.6-p1, < 2.4.6-p72.4.6-p7composer require magento/community-edition:2.4.6-p7 -
>= 2.4.7-p1, < 2.4.7-p22.4.7-p2composer require magento/community-edition:2.4.7-p2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround is to restrict access to sensitive directories and files through server configuration. For example, you can modify your web server's configuration to deny access to specific paths that may be exploited. Here is an example for Apache:
<Directory /path/to/restricted>
Order Deny,Allow
Deny from all
</Directory>
Conclusion
The Magento Community Edition is vulnerable to a path traversal issue that could allow unauthorized access to sensitive files. Users are strongly advised to upgrade to the latest versions to mitigate this risk. Temporary workarounds can be implemented, but upgrading is the most effective solution.
See every vulnerability recorded for magento/community-edition →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized access to sensitive information.
The affected versions include Magento Open Source 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9, and earlier versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If you cannot upgrade immediately, implement server-side restrictions to limit access to sensitive directories as a temporary workaround.
The CVSS score of this vulnerability is 6.8, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
