CVE-2024-45125: Magento Open Source Incorrect Authorization Vulnerability
Summary
CVE-2024-45125: Magento Open Source Incorrect Authorization vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45125 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that allows businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. The platform is built on PHP and is known for its flexibility and scalability. However, certain versions of Magento Open Source are vulnerable to an Incorrect Authorization issue that could allow low-privileged attackers to bypass security features.
Vulnerability Detail
The Incorrect Authorization vulnerability in Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier can lead to a security feature bypass. This vulnerability arises from improper validation of user permissions, allowing attackers with low privileges to exploit the system. The potential ramifications include unauthorized access to sensitive data, which could compromise the integrity of the application. Exploitation does not require user interaction, making it a significant risk for affected installations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that user permissions are strictly managed and monitor access logs for any suspicious activity. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The Incorrect Authorization vulnerability in Magento Open Source poses a significant risk to affected installations. It is crucial for users to update to the latest patched versions to mitigate this risk. Regular monitoring and strict user permission management can help reduce the impact of such vulnerabilities.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
No, exploitation of this vulnerability does not require user interaction, making it easier for attackers to exploit.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If you cannot update immediately, ensure strict management of user permissions and monitor access logs for any unusual activity until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
