CVE-2024-45121: Magento Open Source Improper Access Control Vulnerability
Summary
CVE-2024-45121: Magento Open Source Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source have been found to be vulnerable to an improper access control issue, which could allow low-privileged attackers to bypass security measures.
Vulnerability Detail
The vulnerability identified as CVE-2024-45121 affects Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. It stems from improper access control mechanisms that fail to adequately restrict access to certain functionalities. As a result, a low-privileged attacker could exploit this flaw to bypass security features, potentially compromising the integrity of the system. The exploitation does not require user interaction, making it a significant risk for affected installations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that access controls are manually reviewed and tightened where possible until the update can be applied. This may include restricting access to sensitive areas of the application and monitoring logs for unusual activity.
Conclusion
CVE-2024-45121 represents a significant security risk for Magento Open Source users. It is crucial to update to the latest patched versions to protect against potential exploitation. Regular monitoring and access control reviews are recommended to maintain security.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45121 is a vulnerability in Magento Open Source that allows low-privileged attackers to bypass security features due to improper access control.
Affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 4.3, indicating a moderate level of risk.
If an immediate update is not possible, review and tighten access controls as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
