Vulnerability advisory
CVE-2024-20720
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Also known as GHSA-525f-pvj5-vqmq
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/magento2 ↗ | |
| 0f9a056c8d83c4f319626b3e56ec52a533999f25 through 6cc0d28cf66074adebc261e981eb35811601f813 | No fix listed |
Also listed as affected (17)
| |
Description
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.