CVE-2024-45127: Magento Community Edition Stored XSS Vulnerability
Summary
CVE-2024-45127: Magento Open Source stored Cross-Site Scripting (XSS) vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45127 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that allows businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by malicious actors to inject harmful scripts into the application.
Vulnerability Detail
The vulnerability exists in Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. An attacker with admin privileges can exploit this vulnerability by injecting malicious JavaScript into vulnerable form fields. When a victim accesses a page containing the compromised field, the injected script may execute in their browser, potentially leading to data theft, session hijacking, or other malicious activities. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) and has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider restricting admin access to trusted users only and monitoring form submissions for any unusual activity. Additionally, implement Content Security Policy (CSP) headers to help mitigate the impact of potential XSS attacks.
Conclusion
The stored XSS vulnerability in Magento Open Source poses a significant risk to users, particularly those with admin access. It is crucial to update to the latest patched versions to protect against potential exploits. Regular monitoring and employing security best practices can further mitigate risks associated with this vulnerability.
See every vulnerability recorded for magento/community-edition →
FAQ
Stored XSS occurs when an attacker is able to inject malicious scripts into a web application, which are then stored on the server and executed when a user accesses the affected page.
Check the version of your Magento installation. If it is one of the affected versions (2.4.7-p2, 2.4.6-p7, etc.), then it is vulnerable.
An attacker could execute arbitrary JavaScript in the context of a victim's browser, leading to data theft, session hijacking, or unauthorized actions on behalf of the user.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. You can check your application against known vulnerabilities without any signup at the Vulert playground.
Implement workarounds such as restricting admin access and monitoring for unusual activity, as well as applying CSP headers to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
