Magento Open Source Improper Input Validation vulnerability

高 7.6CVE-2024-45117 · GHSA-3fr3-gcqh-3m2g · 10/10/2024 公開 · 17/06/2026 更新

要点

CVE-2024-45117 は magento/community-edition, commerce (adobe), commerce b2b (adobe) に影響する深刻度「高」 (CVSS 7.6) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.85%（全脆弱性の 58.1% より高い）。
対処：2.4.5-p10, 2.4.6-p8, 2.4.7-p3, 2.4.4-p11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
magento/community-edition Packagist	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7≥ 2.4.5-p1, < 2.4.5-p10≥ 2.4.6-p1, < 2.4.6-p8≥ 2.4.7-beta1, < 2.4.7-p3< 2.4.4-p11`	`2.4.5-p102.4.6-p82.4.7-p32.4.4-p11`
commerce adobe	`= 2.3.7= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.4.4= 2.4.5= 2.4.6= 2.4.7`	修正版なし
commerce b2b adobe	`= 1.3.3= 1.3.4= 1.3.5= 1.4.2`	修正版なし
magento adobe	`= 2.4.3= 2.4.4= 2.4.5= 2.4.6= 2.4.7`	修正版なし

概要

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories via PHP filter chain and also can have a low-availability impact on the service. Exploitation of this issue does not require user interaction and scope is changed.

NVD の説明

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories via PHP filter chain and also can have a low-availability impact on the service. Exploitation of this issue does not require user interaction and scope is changed.