GitHub Advisoryadvisory · Packagist

GHSA-525f-pvj5-vqmq Magento Open Source allows OS Command Injection

HIGH Published 2024-02-15 Modified 2025-03-04 Official page ↗
Aliases
CVE-2024-20720
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2025-03-04

Affected packages

• Packagist magento/community-edition: 2.4.6 (no fix yet) • Packagist magento/community-edition: 2.4.5 (no fix yet) • Packagist magento/community-edition: 2.4.4 (no fix yet) • Packagist magento/community-edition: >= 2.4.6-p1, < 2.4.6-p4 → fixed in 2.4.6-p4 • Packagist magento/community-edition: >= 2.4.5-p1, < 2.4.5-p6 → fixed in 2.4.5-p6 • Packagist magento/community-edition: >= 2.4.4-p1, < 2.4.4-p7 → fixed in 2.4.4-p7 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

Related

Alias · CVE (1)

  • CVE-2024-20720 Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References