Protection from CVE-2024-45115 (Adobe Commerce and Magento Open Source Improper Authentication)
An authentication bypass and privilege escalation vulnerability has been found in Adobe Commerce and Magento Open Source and has been assigned CVE-2024-45115. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below.
Next-Gen WAF control panel
- Professional or Premier platform
- Essentials platform
Log in to the Next-Gen WAF control panel.
From the Sites menu, select a site if you have more than one site.
- From the Rules menu, select Templated Rules.
- In the search bar, enter
CVE-2024-45115and then click View for the CVE-2024-45115 templated rule. - Click Configure and then Add trigger.
- Select the Block requests from an IP immediately if the CVE-2024-45115 signal is observed checkbox.
- Click Update rule.
Fastly control panel
Log in to the Fastly control panel.
Go to Security > Next-Gen WAF > Workspaces.
- Click Virtual Patches.
- In the search bar, enter
CVE-2024-45115and then click the pencil to the right of the CVE-2024-45115 virtual patch. - From the Status menu, select Enabled.
- (Optional) If your workspace is in blocking mode, choose whether to Block requests or Log requests if the CVE-2024-45115 signal is observed.
- Click Update virtual patch.
Prior change: Next-Gen WAF on Compute for Edge WAF deployments
Following change: Immediate end-of-support for Windows Server 2008 & Windows Server 2012
