CVE-2024-39409: Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.33288%
CWE
Published
8/14/2024
Updated
9/16/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.4.7-p1, < 2.4.7-p2 | 2.4.7-p2 |
| magento/community-edition | composer | = 2.4.7 | |
| magento/community-edition | composer | >= 2.4.6-p1, < 2.4.6-p7 | 2.4.6-p7 |
| magento/community-edition | composer | = 2.4.6 | |
| magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p9 | 2.4.5-p9 |
| magento/community-edition | composer | = 2.4.5 | |
| magento/community-edition | composer | < 2.4.4-p10 | 2.4.4-p10 |
| magento/community-edition | composer | = 2.4.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description indicates missing CSRF protections for minor actions. Magento's CSRF protection relies on validating form_key parameters in state-changing requests. Without commit diffs, we infer vulnerable endpoints are controller actions handling POST/PUT requests without proper CSRF token checks. The medium confidence reflects the lack of explicit patch details, but the pattern matches Magento's typical CSRF fixes where controllers omit form_key validation. The 'minor actions' description suggests non-critical endpoints (e.g., UI preferences, notifications) rather than core administrative functions.