MB-R049 — CVE match via OSV

C09 Extension Vulnerability Management Critical

Installed extensions must be scanned against OSV.dev and other vulnerability databases for known CVEs. Unpatched vulnerabilities in third-party modules are one of the top entry points for attackers. Regularly check advisories and flag modules with unresolved security issues.

Why it Matters

Magento relies on many third-party extensions. If an installed extension version is listed as vulnerable in the OSV (Open Source Vulnerabilities) database, it means known exploits exist. Running outdated or vulnerable extensions leaves the store open to remote code execution, data leaks, or payment fraud.

Checking extensions against OSV ensures your store is not running versions with public CVEs. Staying up to date with vulnerability advisories is a key part of Magento security maintenance.

Verification Steps

Composer + OSV check

# List all installed extensions with versions
composer show --direct

# Use osv-scanner to check for CVEs
osv-scanner --lockfile=./composer.lock

Expected

No installed extension version should match a known CVE in OSV.

Remediation / Fix Guidance

Identify affected extensions using osv-scanner or Magebean CVE bundle.
Upgrade to a patched version using Composer:
```
composer require vendor/extension:^x.y.z
```
If no patched version exists, remove or replace the extension with a maintained alternative.
Verify store functionality after upgrade, then deploy changes to production.
Automate vulnerability checks in CI/CD so outdated packages are flagged before release.

Examples

Fail Example

$ osv-scanner --lockfile=./composer.lock
VULNERABLE: vendor/payment-module 1.2.3
CVE-2024-12345: SQL Injection in checkout

Pass Example

$ osv-scanner --lockfile=./composer.lock
No vulnerabilities found → PASS