Magento Open Source allows Incorrect Authorization
The advisory, in context
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privilege escalation.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.4.7-beta1 before 2.4.7-beta2
Fixed in 2.4.7-beta2
1 explicitly affected versions
2.4.7-beta1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.7-beta1"
},
{
"fixed": "2.4.7-beta2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.7-beta1"
]
}1 explicitly affected versions
2.4.6
View affected-version evidence
{
"ranges": [],
"versions": [
"2.4.6"
]
}1 explicitly affected versions
2.4.5
View affected-version evidence
{
"ranges": [],
"versions": [
"2.4.5"
]
}1 explicitly affected versions
2.4.4
View affected-version evidence
{
"ranges": [],
"versions": [
"2.4.4"
]
}From 2.4.6-p1 before 2.4.6-p3
Fixed in 2.4.6-p3
2 explicitly affected versions
2.4.6-p1, 2.4.6-p2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.6-p1"
},
{
"fixed": "2.4.6-p3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.6-p1",
"2.4.6-p2"
]
}From 2.4.5-p1 before 2.4.5-p5
Fixed in 2.4.5-p5
4 explicitly affected versions
2.4.5-p1, 2.4.5-p2, 2.4.5-p3, 2.4.5-p4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.5-p1"
},
{
"fixed": "2.4.5-p5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.5-p1",
"2.4.5-p2",
"2.4.5-p3",
"2.4.5-p4"
]
}From 2.4.4-p1 before 2.4.4-p6
Fixed in 2.4.4-p6
5 explicitly affected versions
2.4.4-p1, 2.4.4-p2, 2.4.4-p3, 2.4.4-p4, 2.4.4-p5
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.4-p1"
},
{
"fixed": "2.4.4-p6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.4-p1",
"2.4.4-p2",
"2.4.4-p3",
"2.4.4-p4",
"2.4.4-p5"
]
}Earlier releases through 2.0.2 (inclusive)
No fix recorded for this interval.
53 explicitly affected versions
0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103, 0.1.0-alpha104, 0.1.0-alpha105, 0.1.0-alpha106, 0.1.0-alpha107, 0.1.0-alpha108, 0.1.0-alpha89, 0.1.0-alpha90, 0.1.0-alpha91, 0.1.0-alpha92, 0.1.0-alpha93, 0.1.0-alpha94, 0.1.0-alpha95, 0.1.0-alpha96, 0.1.0-alpha97, 0.1.0-alpha98, 0.1.0-alpha99, 0.42.0-beta1, 0.42.0-beta10, 0.42.0-beta11, 0.42.0-beta2, 0.42.0-beta3, 0.42.0-beta4, 0.42.0-beta5, 0.42.0-beta6, 0.42.0-beta7, 0.42.0-beta8, 0.42.0-beta9, 0.74.0-beta1, 0.74.0-beta10, 0.74.0-beta11, 0.74.0-beta12, 0.74.0-beta13, 0.74.0-beta14, 0.74.0-beta15, 0.74.0-beta16, 0.74.0-beta2, 0.74.0-beta3, 0.74.0-beta4, 0.74.0-beta5, 0.74.0-beta6, 0.74.0-beta7, 0.74.0-beta8, 0.74.0-beta9, 1.0.0-beta, 2.0.0, 2.0.0-rc, 2.0.0-rc2, 2.0.1, 2.0.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0-alpha100",
"0.1.0-alpha101",
"0.1.0-alpha102",
"0.1.0-alpha103",
"0.1.0-alpha104",
"0.1.0-alpha105",
"0.1.0-alpha106",
"0.1.0-alpha107",
"0.1.0-alpha108",
"0.1.0-alpha89",
"0.1.0-alpha90",
"0.1.0-alpha91",
"0.1.0-alpha92",
"0.1.0-alpha93",
"0.1.0-alpha94",
"0.1.0-alpha95",
"0.1.0-alpha96",
"0.1.0-alpha97",
"0.1.0-alpha98",
"0.1.0-alpha99",
"0.42.0-beta1",
"0.42.0-beta10",
"0.42.0-beta11",
"0.42.0-beta2",
"0.42.0-beta3",
"0.42.0-beta4",
"0.42.0-beta5",
"0.42.0-beta6",
"0.42.0-beta7",
"0.42.0-beta8",
"0.42.0-beta9",
"0.74.0-beta1",
"0.74.0-beta10",
"0.74.0-beta11",
"0.74.0-beta12",
"0.74.0-beta13",
"0.74.0-beta14",
"0.74.0-beta15",
"0.74.0-beta16",
"0.74.0-beta2",
"0.74.0-beta3",
"0.74.0-beta4",
"0.74.0-beta5",
"0.74.0-beta6",
"0.74.0-beta7",
"0.74.0-beta8",
"0.74.0-beta9",
"1.0.0-beta",
"2.0.0",
"2.0.0-rc",
"2.0.0-rc2",
"2.0.1",
"2.0.2"
]
}