CVE-2024-39412: Magento Open Source Improper Authorization Vulnerability
Summary
CVE-2024-39412: Magento Open Source Improper Authorization vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p10
>= 2.4.5-p1, < 2.4.5-p9
>= 2.4.6-p1, < 2.4.6-p7
>= 2.4.7-p1, < 2.4.7-p2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source are vulnerable to an improper authorization issue, which can lead to security feature bypass and unauthorized information disclosure.
Vulnerability Detail
The vulnerability arises from improper authorization mechanisms in Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier. This flaw allows low-privileged attackers to bypass security measures, potentially disclosing minor information without requiring user interaction. The issue is categorized under CWE-285, indicating a weakness in access control that can lead to unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p102.4.4-p10composer require magento/community-edition:2.4.4-p10 -
>= 2.4.5-p1, < 2.4.5-p92.4.5-p9composer require magento/community-edition:2.4.5-p9 -
>= 2.4.6-p1, < 2.4.6-p72.4.6-p7composer require magento/community-edition:2.4.6-p7 -
>= 2.4.7-p1, < 2.4.7-p22.4.7-p2composer require magento/community-edition:2.4.7-p2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting access to sensitive areas of your Magento installation by implementing additional access controls or monitoring user activities closely until the vulnerability can be patched.
Conclusion
The improper authorization vulnerability in Magento Open Source poses a risk of unauthorized information disclosure. It is crucial for users of affected versions to upgrade to the latest releases to mitigate this risk. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-39412 is an identifier for a vulnerability in Magento Open Source that allows low-privileged attackers to bypass security measures and disclose minor information.
The affected versions include Magento Open Source 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9, and earlier versions.
You can use Vulert, which monitors open-source vulnerabilities in your software using the composer.lock file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
If you cannot upgrade immediately, consider implementing additional access controls or monitoring user activities closely as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
