CVE-2024-45129: Magento Open Source Improper Access Control Vulnerability
Summary
CVE-2024-45129: Magento Open Source Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45129 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. The platform is built on PHP and is known for its flexibility and scalability. However, certain versions of Magento Open Source have been found to be vulnerable to an improper access control issue, which could allow low-privileged attackers to escalate their privileges and bypass security measures.
Vulnerability Detail
The vulnerability identified as CVE-2024-45129 affects Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. It stems from improper access control mechanisms that fail to adequately restrict user permissions. This flaw allows low-privileged attackers to exploit the system, potentially leading to privilege escalation. The impact on integrity is low, but the vulnerability can be exploited without user interaction, making it a significant security concern.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can review and tighten access control settings for user roles within the Magento admin panel to mitigate the risk of unauthorized access until the patch is applied.
Conclusion
The improper access control vulnerability in Magento Open Source poses a risk of privilege escalation for low-privileged attackers. It is crucial for users of affected versions to apply the necessary updates promptly to safeguard their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45129 is an improper access control vulnerability in Magento Open Source that allows low-privileged attackers to escalate their privileges.
The affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
If immediate updates are not possible, review and tighten access control settings for user roles in the Magento admin panel as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
