Vulnerability advisory

CVE-2024-39402

Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published Aug 14, 2024Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
All commits through 4c36116dcf878e127059d9be9566a119783583f2	No fix listed
0f9a056c8d83c4f319626b3e56ec52a533999f25 through d196d504d8b387454a123033ec2a74d7fd3d5430	No fix listed
Also listed as affected (63) `2.4.4-NA` `2.4.4-p1` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9` `2.4.5-NA` `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.5-p8` `2.4.6-NA` `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.6-p6` `2.4.7-NA` `2.4.7-b1` `2.4.7-b2` `2.4.7-p2` `2.4.3` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

CVE-2024-39402

Affected versions

Repository

Description

References