Vulnerability advisory

CVE-2020-24407

Published Nov 9, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2020-24407GHSA-7pxg-6p87-8c9v

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before b69fab3da87a1536e1a583e51c8115e3f843609b	`b69fab3da87a1536e1a583e51c8115e3f843609b`
b69fab3da87a1536e1a583e51c8115e3f843609b through b69fab3da87a1536e1a583e51c8115e3f843609b	No fix listed
Also listed as affected (18) `2.3.5-NA` `2.3.0` `2.2.7` `2.1.16` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before dcc962efc5ad12717c6eac0f10cf822780dd3f4a	`dcc962efc5ad12717c6eac0f10cf822780dd3f4a`
dcc962efc5ad12717c6eac0f10cf822780dd3f4a through 6729b6e01368248abc33300208eb292c95050203	No fix listed
Also listed as affected (40) `2.3.5-NA` `2.3.5-p1` `2.4.0` `2.3.4` `2.3.3` `2.3.2` `2.3.1` `2.3.0` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb20-59.html ↗