GitHub Advisoryadvisory · Packagist

GHSA-7pxg-6p87-8c9v Magento 2 Community Edition RCE via Unsafe File Upload

CRITICAL Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2020-24407
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-07-13

Affected packages

• Packagist magento/community-edition: < 2.4.1 → fixed in 2.4.1 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

Related

Alias · CVE (1)

  • CVE-2020-24407 Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References