Vulnerability advisory

CVE-2024-20758

Adobe Commerce | Improper Input Validation (CWE-20)

Published Apr 10, 2024Updated Oct 28, 2026OSV record ↗

Also known as BIT-magento-2024-20758GHSA-wh4m-6rh3-p4rq

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
44a7b6079bcac5ba92040b16f4f74024b4f34d09 through 2090f74025ddc4da7d453f6864f245e26dc0b19a	No fix listed
Also listed as affected (40) `2.3.7-NA` `2.3.7-p1` `2.3.7-p2` `2.3.7-p3` `2.3.7-p4` `2.4.0-NA` `2.4.0-ext\-1` `2.4.1-NA` `2.4.1-ext\-1` `2.4.2-NA` `2.4.2-ext\-1` `2.4.2-ext\-2` `2.4.3-NA` `2.4.3-ext\-1` `2.4.3-ext\-2` `2.4.3-ext\-3` `2.4.4-NA` `2.4.4-p1` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.5-NA` `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.6-NA` `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.7-NA` `2.4.7-b1` `2.4.7-b2` `2.4.7-beta3`

Description

Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.

CVE-2024-20758

Affected versions

Repository

Description

References