CVE-2025-24408: Magento Community Edition Information Exposure Vulnerability
Summary
CVE-2025-24408: Magento Information Exposure vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely used open-source e-commerce platform that provides businesses with a flexible shopping cart system, control over the look and feel of their online store, and a range of features to enhance customer experience. The platform is known for its scalability and customization options, making it a popular choice for both small and large enterprises. However, certain versions of Magento have been found to be vulnerable to an Information Exposure issue, which could allow low-privileged attackers to gain unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2025-24408 affects Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. It arises from improper handling of user permissions, which could lead to privilege escalation. A low-privileged attacker could exploit this vulnerability to access sensitive information without requiring any user interaction. This poses a significant risk to the integrity and confidentiality of user data within the affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, it is recommended to restrict access to sensitive information and monitor user permissions closely until the patch is applied. Additionally, consider implementing additional security measures such as two-factor authentication for user accounts.
Conclusion
The CVE-2025-24408 vulnerability poses a significant risk to Magento Community Edition users, allowing unauthorized access to sensitive information. It is essential to update to the patched versions to mitigate this risk and ensure the security of your e-commerce platform.
See every vulnerability recorded for magento/community-edition →
FAQ
CVE-2025-24408 is a vulnerability in Magento Community Edition that allows low-privileged attackers to gain unauthorized access to sensitive information due to improper handling of user permissions.
Affected versions include Adobe Commerce 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
If immediate updates are not possible, restrict access to sensitive information and monitor user permissions closely as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
