CVE-2024-45133: Magento Open Source Information Exposure Vulnerability
Summary
CVE-2024-45133: Magento Open Source Information Exposure vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45133 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely-used eCommerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source are vulnerable to an Information Exposure issue that could allow unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in Magento Open Source arises from a security feature bypass that can be exploited by an admin attacker. This could lead to a low impact on confidentiality, potentially facilitating further attacks. The affected versions include 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10 and earlier. Exploitation does not require user interaction, making it particularly concerning for users of these versions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that only trusted administrators have access to the Magento admin panel and monitor for any unusual activity. Regularly review user permissions to minimize the risk of exploitation.
Conclusion
The Information Exposure vulnerability in Magento Open Source poses a risk to user confidentiality and could facilitate further attacks. It is crucial for users of affected versions to update to the latest patched versions to mitigate this risk.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45133 is a vulnerability in Magento Open Source that allows for information exposure due to a security feature bypass.
Affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 2.7, indicating a moderate severity level.
If immediate updates are not possible, ensure that only trusted users have access to the admin panel and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
