CVE-2024-45149: Magento Community Edition Improper Access Control Vulnerability
Summary
CVE-2024-45149: Magento Open Source Improper Access Control vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-p1, < 2.4.5-p10
>= 2.4.6-p1, < 2.4.6-p8
>= 2.4.7-beta1, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento · Bitnami
The same CVE-2024-45149 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides a flexible shopping cart system, as well as control over the look, content, and functionality of online stores. It is known for its rich feature set, including marketing tools, customer segmentation, and a robust API for integration. However, certain versions of Magento are vulnerable to an improper access control issue, which could allow low-privileged attackers to bypass security measures.
Vulnerability Detail
The vulnerability arises from improper access control mechanisms in Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier. This flaw allows low-privileged attackers to bypass security features, potentially leading to unauthorized access to sensitive information. The issue does not require user interaction, making it easier for attackers to exploit. The vulnerability is classified under CWE-284, indicating a failure to enforce proper access controls.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11composer require magento/community-edition:2.4.4-p11 -
>= 2.4.5-p1, < 2.4.5-p102.4.5-p10composer require magento/community-edition:2.4.5-p10 -
>= 2.4.6-p1, < 2.4.6-p82.4.6-p8composer require magento/community-edition:2.4.6-p8 -
>= 2.4.7-beta1, < 2.4.7-p32.4.7-p3composer require magento/community-edition:2.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, administrators can restrict access to sensitive areas of the application until the patch is applied. This can be done by modifying user roles and permissions to limit access for low-privileged users.
Conclusion
The improper access control vulnerability in Magento Community Edition poses a risk to the confidentiality of sensitive information. It is crucial for users of affected versions to apply the necessary updates to mitigate this risk. By staying informed and proactive, organizations can protect their e-commerce platforms from potential exploitation.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2024-45149 is a vulnerability in Magento Community Edition that allows low-privileged attackers to bypass security controls due to improper access management.
Affected versions include Magento 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier versions.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 2.7, indicating a low severity level.
If immediate updates are not possible, consider implementing stricter access controls and monitoring user activity until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
