CVE-2024-45131: Magento Open Source Improper Authorization Vulnerability
Summary
CVE-2024-45131: Magento Open Source Improper Authorization vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45131 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that allows businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source are vulnerable to an Improper Authorization issue, which can lead to security feature bypasses, potentially compromising the integrity and confidentiality of the system.
Vulnerability Detail
The vulnerability arises from improper authorization checks in Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. A low-privileged attacker can exploit this flaw to bypass security measures, allowing unauthorized access to sensitive functionalities. This could lead to a low impact on both confidentiality and integrity of the system, as the attacker may gain access to information or actions that should be restricted.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider restricting access to sensitive areas of your Magento installation until the patch is applied. This can be done by modifying user roles and permissions in the Magento admin panel to limit access for low-privileged users.
Conclusion
The Improper Authorization vulnerability in Magento Open Source poses a risk to users of affected versions. It is crucial to update to the latest patched versions to mitigate potential security risks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45131 is a vulnerability in Magento Open Source that allows low-privileged attackers to bypass security measures due to improper authorization.
Affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier.
The vulnerability could lead to unauthorized access to sensitive functionalities, impacting the confidentiality and integrity of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
