CVE-2024-34103: Magento Open Source Improper Authentication vulnerability
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.
Published Jun 13, 2024 · Updated Nov 18, 2024
Affected packages
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.7
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.6
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.5
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.4
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.4.6-p1, < 2.4.6-p6
- Fixed in
- 2.4.6-p6
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.4.5-p1, < 2.4.5-p8
- Fixed in
- 2.4.5-p8
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- < 2.4.4-p9
- Fixed in
- 2.4.4-p9
- Check
composer show magento/community-edition
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-34103
- https://helpx.adobe.com/security/products/magento/apsb24-40.html
- https://github.com/magento/magento2/commit/30877fce83b793f71421c47347885cf076e81799
- https://github.com/magento/magento2/commit/a3c6d6e5e95e63031e4df26cfcf76feace7549c2
- https://github.com/magento/magento2/commit/c5c538810b87449886f4669cb8abbe8e5593c83c
- https://github.com/magento/magento2/commit/d10435b11ada4e502dca7539f8fd31d059d3c482
- https://github.com/advisories/GHSA-f7q4-9gwv-6774
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesCVE-2025-54236
Magento Community Edition Improper Input Validation vulnerability
critical9.1ExploitedNo fixSep 9, 2025CVE-2025-47110
Magneto contains stored XSS vulnerability
critical9.1No fixJun 10, 2025CVE-2025-24434
Improper Authorization vulnerability in Magento and Adobe Commerce
critical9.1No fixFeb 11, 2025CVE-2024-34102
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
critical9.8ExploitedNo fixJun 13, 2024GHSA-26hq-7286-mg8f
Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
criticalMay 15, 2024GHSA-5gmh-85x8-5cx7
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
criticalMay 15, 2024