-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.4.7-beta1, < 2.4.7-p3 | 2.4.7-p3 |
| magento/community-edition | composer | >= 2.4.6-p1, < 2.4.6-p8 | 2.4.6-p8 |
| magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p10 | 2.4.5-p10 |
| magento/community-edition | composer | < 2.4.4-p11 | 2.4.4-p11 |
| magento/community-edition | composer | = 2.4.7 | |
| magento/community-edition | composer | = 2.4.6 | |
| magento/community-edition | composer | = 2.4.5 | |
| magento/community-edition | composer | = 2.4.4 |
Miggo AIRoot Cause AnalysisThe vulnerability centers around improper authorization (CWE-285/863) in Magento's admin controllers. Without patch details, we infer vulnerable patterns where critical admin actions might: 1. Lack _isAllowed() method implementation 2. Use incorrect ACL resource identifiers 3. Fail to validate admin user permissions. Wishlist and order gift message controllers are common areas for such oversights. The medium confidence reflects the lack of direct patch evidence, but aligns with Magento's typical authorization patterns and the advisory's description of admin-adjacent functionality being vulnerable to privilege escalation.