CVE-2024-20720

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb24-03.html	Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb24-03.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:commerce:2.4.4:-::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p6::::::
	cpe:2.3:a:adobe:commerce:2.4.5:-::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.6:-::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p3::::::

History

21 Nov 2024, 08:53

Type	Values Removed	Values Added
References	~~() https://helpx.adobe.com/security/products/magento/apsb24-03.html - Vendor Advisory~~	() https://helpx.adobe.com/security/products/magento/apsb24-03.html - Vendor Advisory

16 Feb 2024, 20:14

Type	Values Removed	Values Added
CPE		cpe:2.3:a:adobe:commerce:2.4.6:-:::::: cpe:2.3:a:adobe:commerce:2.4.4:p5:::::: cpe:2.3:a:adobe:commerce:2.4.4:p3:::::: cpe:2.3:a:adobe:commerce:2.4.5:p1:::::: cpe:2.3:a:adobe:commerce:2.4.5:p2:::::: cpe:2.3:a:adobe:commerce:2.4.4:p2:::::: cpe:2.3:a:adobe:commerce:2.4.4:-:::::: cpe:2.3:a:adobe:commerce:2.4.4:p6:::::: cpe:2.3:a:adobe:commerce:2.4.4:p4:::::: cpe:2.3:a:adobe:commerce:2.4.5:p4:::::: cpe:2.3:a:adobe:commerce:2.4.6:p2:::::: cpe:2.3:a:adobe:commerce:2.4.5:-:::::: cpe:2.3:a:adobe:commerce:2.4.5:p5:::::: cpe:2.3:a:adobe:commerce:2.4.6:p3:::::: cpe:2.3:a:adobe:commerce:2.4.5:p3:::::: cpe:2.3:a:adobe:commerce:2.4.6:p1:::::: cpe:2.3:a:adobe:commerce:2.4.4:p1::::::
References	~~() https://helpx.adobe.com/security/products/magento/apsb24-03.html -~~	() https://helpx.adobe.com/security/products/magento/apsb24-03.html - Vendor Advisory
First Time		Adobe commerce Adobe

15 Feb 2024, 14:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-15 14:15

Updated : 2024-11-21 08:53

NVD link : CVE-2024-20720

Mitre link : CVE-2024-20720

CVE.ORG link : CVE-2024-20720

JSON object : View

Products Affected

adobe

commerce

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

9.1 /10