CVE-2024-45132: Magento Improper Authorization Vulnerability Leading to Privilege Escalation
Summary
CVE-2024-45132: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. Affects magento across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-alpha0, < 2.4.5-p10
>= 2.4.6-alpha0, < 2.4.6-p8
>= 2.4.7-alpha0, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento/community-edition · Packagist
The same CVE-2024-45132 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Adobe Commerce, commonly known as Magento, is an open-source e-commerce platform that provides businesses with a flexible and scalable solution for online sales. It offers a wide range of features including product management, customer management, and order processing. However, certain versions of Magento are vulnerable to an improper authorization issue, which can allow low-privileged attackers to bypass security measures and potentially compromise sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2024-45132 affects Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier. It stems from improper authorization checks that could enable a low-privileged attacker to escalate their privileges. This exploitation does not require user interaction, making it particularly dangerous as it can lead to unauthorized access to confidential data and compromise the overall security of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11 -
>= 2.4.5-alpha0, < 2.4.5-p102.4.5-p10 -
>= 2.4.6-alpha0, < 2.4.6-p82.4.6-p8 -
>= 2.4.7-alpha0, < 2.4.7-p32.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the recommended updates as soon as possible.
Conclusion
The CVE-2024-45132 vulnerability in Adobe Commerce (Magento) poses a significant risk due to improper authorization that can lead to privilege escalation. It is crucial for users of affected versions to update their installations to the latest patched versions to mitigate this risk. Regular monitoring and updates are essential for maintaining the security of your e-commerce platform.
See every vulnerability recorded for magento →
FAQ
CVE-2024-45132 is a vulnerability in Adobe Commerce (Magento) that allows low-privileged attackers to escalate their privileges due to improper authorization checks.
The affected versions include Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, compromising the confidentiality of the application and potentially leading to further attacks.
No, exploitation of this vulnerability does not require user interaction, making it more critical to address promptly.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento.
