CVE-2024-45149: Magento Improper Access Control Vulnerability
Summary
CVE-2024-45149: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. Affects magento across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-alpha0, < 2.4.5-p10
>= 2.4.6-alpha0, < 2.4.6-p8
>= 2.4.7-alpha0, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento/community-edition · Packagist
The same CVE-2024-45149 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Adobe Commerce, commonly known as Magento, is a leading open-source e-commerce platform that provides businesses with a flexible and scalable solution for online sales. It offers a wide range of features including product management, customer segmentation, and marketing tools. However, certain versions of Magento have been found to be vulnerable to an improper access control issue, which could allow low-privileged attackers to bypass security measures.
Vulnerability Detail
The vulnerability identified as CVE-2024-45149 affects Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier. It stems from improper access control mechanisms, which could enable a low-privileged attacker to bypass security features, potentially compromising the confidentiality of sensitive information. The exploitation of this vulnerability does not require user interaction, making it particularly concerning for affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11 -
>= 2.4.5-alpha0, < 2.4.5-p102.4.5-p10 -
>= 2.4.6-alpha0, < 2.4.6-p82.4.6-p8 -
>= 2.4.7-alpha0, < 2.4.7-p32.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
CVE-2024-45149 is a significant vulnerability affecting various versions of Adobe Commerce (Magento) due to improper access control. It is essential for users to update their installations to the patched versions to safeguard against potential exploitation. Regular monitoring and timely updates are crucial for maintaining the security of your e-commerce platform.
See every vulnerability recorded for magento →
FAQ
CVE-2024-45149 is a vulnerability in Adobe Commerce (Magento) that allows low-privileged attackers to bypass security features due to improper access control.
Affected versions include Adobe Commerce 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
The potential impacts include unauthorized access to sensitive information, which could lead to data breaches and loss of customer trust.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento.
