Tried to patch magento open source 2.4.6-p6 with the file: vuln-25610-composer-patch.zip
But I do not have file: vendor/magento/module-company/Plugin/Customer/Api/AccountManagement.php
What should I do... :)
3 Answers
The extension that is patched here (magento/module-company) is only available as part of the Commerce version, and even then only for the B2B module offered by it. Therefore you do not need to add this patch to your open-source project. If you check the vendor folder, you will not find that extension under the Magento subfolder.
The Isolated Patch for CVE-2024-45115 applies only to Adobe Commerce B2B, specifically versions 1.3.3 to 1.4.2. Magento Open Source is not affected by CVE-2024-45115. Therefore, you do not need to apply this patch to your Magento Open Source site.
When I run Magento Scanner, I receive notice:
APSB24-73 security updates available for Adobe Commerce and Magento Open Source Affected versions: 2.4.7-p2 and earlier.
It appears that patch:vuln-25610-composer-patch.zip is required for Magento Open Source as well:
Can somebody please clarify?
