CVE-2025-24425: Magento Community Edition Business Logic Error Vulnerability
Summary
CVE-2025-24425: Magento Business Logic Error vulnerability. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is a widely-used open-source e-commerce platform that provides businesses with a flexible and scalable solution for online sales. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento are susceptible to a Business Logic Error vulnerability, which can lead to unauthorized data modifications.
Vulnerability Detail
The vulnerability in question is a Business Logic Error that affects Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier. This flaw allows an attacker to bypass intended security mechanisms by manipulating the application's operational logic, resulting in limited data modification without requiring user interaction. The potential ramifications include unauthorized access to sensitive data and the ability to alter application behavior.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
In summary, the Business Logic Error vulnerability in Magento Community Edition poses a risk of unauthorized data modification. It is crucial for users to update to the patched versions to mitigate this risk. Regular monitoring and updates are essential to maintain application security.
See every vulnerability recorded for magento/community-edition →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Affected versions include Adobe Commerce 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier.
No, exploitation of this vulnerability does not require user interaction.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
