CVE-2024-45132: Magento Community Edition Improper Authorization Vulnerability
Summary
CVE-2024-45132: Magento Open Source Improper Authorization vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45132 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a leading open-source e-commerce platform that provides businesses with a flexible and scalable solution for online sales. It offers a wide range of features, including product management, customer segmentation, and marketing tools. However, like any software, it is susceptible to vulnerabilities that can compromise its security and functionality. The vulnerability in question affects multiple versions of Magento Community Edition, specifically versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and earlier, allowing low-privileged attackers to exploit authorization flaws.
Vulnerability Detail
The vulnerability identified as CVE-2024-45132 is an Improper Authorization issue that can lead to privilege escalation within the Magento Community Edition. This flaw allows a low-privileged attacker to bypass security measures, potentially compromising sensitive data and affecting the confidentiality of the system. The exploitation of this vulnerability does not require any user interaction, making it particularly dangerous as it can be executed remotely without the need for direct access to the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that access controls are strictly enforced and monitor user permissions closely until the patch is applied. Regularly review logs for any unauthorized access attempts to mitigate potential risks.
Conclusion
The Improper Authorization vulnerability in Magento Community Edition, identified as CVE-2024-45132, poses significant risks to users by allowing privilege escalation. It is crucial to update to the patched versions to safeguard your system against potential attacks. Regular monitoring and strict access controls are recommended as interim measures.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45132 is an Improper Authorization vulnerability in Magento Community Edition that allows low-privileged attackers to escalate their privileges.
Affected versions include Magento Community Edition 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive information, compromising the confidentiality of the system.
If immediate updates are not possible, enforce strict access controls and monitor user activity to minimize risks until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
