CVE-2024-45124: Magento Open Source Improper Access Control Vulnerability
Summary
CVE-2024-45124: Magento Open Source Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45124 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely-used e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source have been found to be vulnerable to an Improper Access Control issue, which could allow attackers to bypass security measures.
Vulnerability Detail
The vulnerability identified as CVE-2024-45124 affects Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. It stems from improper access control mechanisms that could lead to a security feature bypass. This flaw allows an attacker to exploit the vulnerability without requiring user interaction, potentially compromising the integrity of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The Improper Access Control vulnerability in Magento Open Source poses a significant risk to users of affected versions. It is essential to update to the latest patched versions to safeguard against potential exploitation. Regular monitoring and prompt updates are key to maintaining the security of your e-commerce platform.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45124 is an Improper Access Control vulnerability affecting certain versions of Magento Open Source, allowing attackers to bypass security measures.
Affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2024-45124 is 5.3, indicating a moderate severity level.
While there are no specific workarounds, it is crucial to prioritize updating to a patched version as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
