Vulnerability advisory

BIT-magento-2020-24407

Arbitrary code execution via file import functionality

Published Mar 6, 2024Updated Sep 8, 2026OSV record ↗

Also known as CVE-2020-24407GHSA-7pxg-6p87-8c9v

Severity

Severity not reported.

Affected versions

magento Bitnami

Affected Fixed in

All versions before 2.3.5 2.3.5

2.4.0 to before 2.4.1 2.4.1

Affected	Fixed in
All versions before 2.3.5	`2.3.5`
`2.4.0` to before 2.4.1	`2.4.1`
Severity for this package CVSS 3.x`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Severity for this package

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb20-59.html ↗
Webnvd.nist.gov/vuln/detail/CVE-2020-24407 ↗