Vulnerability advisory

CVE-2020-24400

Published Nov 9, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2020-24400GHSA-pf6w-3pfw-fxvw

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before b69fab3da87a1536e1a583e51c8115e3f843609b	`b69fab3da87a1536e1a583e51c8115e3f843609b`
b69fab3da87a1536e1a583e51c8115e3f843609b through b69fab3da87a1536e1a583e51c8115e3f843609b	No fix listed
Also listed as affected (18) `2.3.5-NA` `2.3.0` `2.2.7` `2.1.16` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before dcc962efc5ad12717c6eac0f10cf822780dd3f4a	`dcc962efc5ad12717c6eac0f10cf822780dd3f4a`
dcc962efc5ad12717c6eac0f10cf822780dd3f4a through 6729b6e01368248abc33300208eb292c95050203	No fix listed
Also listed as affected (39) `2.3.5-NA` `2.4.0` `2.3.4` `2.3.3` `2.3.2` `2.3.1` `2.3.0` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb20-59.html ↗