Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-45119: Adobe Commerce lets admin user read any file on server

CVE-2024-45119 · published 2 years ago

Summary

Versions of Adobe Commerce up to 2.4.7-p2, 2.4.6-p7, 2.4.5-p9 and 2.4.4-p10 allow a user with administrator rights to make the system request any URL it chooses. This can be used to read files from the server’s own storage without needing anyone else to click anything. Apply the latest security patches from Adobe or upgrade to a version where the fix is included.

What to do

Update magento community-edition to version 2.4.7-p3.
Update magento community-edition to version 2.4.6-p8.
Update magento community-edition to version 2.4.5-p10.
Update magento community-edition to version 2.4.4-p11.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	magento	community-edition	>= 2.4.7-beta1, < 2.4.7-p3 >= 2.4.6-p1, < 2.4.6-p8 >= 2.4.5-p1, < 2.4.5-p10 < 2.4.4-p11 2.4.7 2.4.6 2.4.5 2.4.4 Fix: upgrade to 2.4.7-p3
–	adobe	commerce	2.4.4 2.4.5 2.4.6 2.4.7 `cpe:2.3:a:adobe:commerce:2.4.4:-::::::`
–	adobe	commerce_b2b	1.3.3 1.3.4 1.3.5 1.4.2 `cpe:2.3:a:adobe:commerce_b2b:1.3.3:-::::::`
–	adobe	magento	2.4.4 2.4.5 2.4.6 2.4.7 `cpe:2.3:a:adobe:magento:2.4.4:-:::open_source:::*`

Original advisory text

Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-45119 Vendor Advisory
https://github.com/advisories/GHSA-g9fm-wc6h-pvgj
https://helpx.adobe.com/security/products/magento/apsb24-73.html Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45119... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published10 Oct 2024

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-g9fm-wc6h-pvgj · GHSA

CVE-2024-45119 · NVD

CVE-2024-45119 · OSV

Track software like this

Free during beta