CVE-2024-45122: Magento Open Source Improper Access Control Vulnerability
Summary
CVE-2024-45122: Magento Open Source Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that allows businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source are susceptible to an Improper Access Control vulnerability, which can compromise the security measures intended to protect sensitive data.
Vulnerability Detail
The Improper Access Control vulnerability in Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier allows low-privileged attackers to bypass security features. This vulnerability arises from inadequate access control mechanisms, enabling attackers to gain unauthorized access to certain functionalities without needing user interaction. The potential ramifications include unauthorized data exposure, which can impact confidentiality, although the overall impact is considered low.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The Improper Access Control vulnerability in Magento Open Source poses a risk to users of affected versions. It is crucial to update to the latest patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
The affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
Attackers can bypass security measures and potentially gain unauthorized access to sensitive functionalities, impacting confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
