CVE-2024-45134: Magento Open Source Information Exposure Vulnerability
Summary
CVE-2024-45134: Magento Open Source Information Exposure vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45134 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento Open Source is a widely used e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Open Source are susceptible to vulnerabilities that can compromise the security of the application, particularly in terms of information exposure.
Vulnerability Detail
The vulnerability identified as CVE-2024-45134 affects Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier. It is classified as an Information Exposure vulnerability, which allows an admin attacker to bypass security features, potentially leading to a low impact on confidentiality. This could facilitate further attacks without requiring user interaction, making it a significant concern for administrators and users alike.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate this vulnerability aside from updating to the patched versions.
Conclusion
CVE-2024-45134 presents a significant risk to Magento Open Source users, allowing for potential information exposure and security feature bypass. It is imperative to update to the latest patched versions to safeguard your application. Utilize tools like Vulert to monitor vulnerabilities in real-time.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45134 is a vulnerability in Magento Open Source that allows for information exposure, potentially leading to security feature bypass.
Affected versions include Magento Open Source 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 2.7, indicating a moderate level of severity.
While there are no specific workarounds, it is crucial to prioritize updating to the patched versions as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
