Vulnerability advisory

GHSA-wh4m-6rh3-p4rq

Magento Open Source allows Improper Input Validation

Published Apr 10, 2024Updated Mar 4, 2025OSV record ↗

Also known as BIT-magento-2024-20758CVE-2024-20758

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
Affected versions (1) `2.4.6`
Affected versions (1) `2.4.5`
Affected versions (1) `2.4.4`
`2.4.7-beta1` to before 2.4.7	`2.4.7`Advisories →
Also listed as affected (3) `2.4.7-beta1` `2.4.7-beta2` `2.4.7-beta3`
`2.4.6-p1` to before 2.4.6-p5	`2.4.6-p5`Advisories →
Also listed as affected (4) `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4`
`2.4.5-p1` to before 2.4.5-p7	`2.4.5-p7`Advisories →
Also listed as affected (6) `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6`
`2.4.4-p1` to before 2.4.4-p8	`2.4.4-p8`Advisories →
Also listed as affected (7) `2.4.4-p1` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7`

magento/project-community-edition Packagist

All magento/project-community-edition advisories →

Affected Fixed in

All versions through 2.0.2 No fix listed

Affected	Fixed in
All versions through `2.0.2`	No fix listed
Also listed as affected (53) `0.1.0-alpha100` `0.1.0-alpha101` `0.1.0-alpha102` `0.1.0-alpha103` `0.1.0-alpha104` `0.1.0-alpha105` `0.1.0-alpha106` `0.1.0-alpha107` `0.1.0-alpha108` `0.1.0-alpha89` `0.1.0-alpha90` `0.1.0-alpha91` `0.1.0-alpha92` `0.1.0-alpha93` `0.1.0-alpha94` `0.1.0-alpha95` `0.1.0-alpha96` `0.1.0-alpha97` `0.1.0-alpha98` `0.1.0-alpha99` `0.42.0-beta1` `0.42.0-beta10` `0.42.0-beta11` `0.42.0-beta2` `0.42.0-beta3` `0.42.0-beta4` `0.42.0-beta5` `0.42.0-beta6` `0.42.0-beta7` `0.42.0-beta8` `0.42.0-beta9` `0.74.0-beta1` `0.74.0-beta10` `0.74.0-beta11` `0.74.0-beta12` `0.74.0-beta13` `0.74.0-beta14` `0.74.0-beta15` `0.74.0-beta16` `0.74.0-beta2` `0.74.0-beta3` `0.74.0-beta4` `0.74.0-beta5` `0.74.0-beta6` `0.74.0-beta7` `0.74.0-beta8` `0.74.0-beta9` `1.0.0-beta` `2.0.0` `2.0.0-rc` `2.0.0-rc2` `2.0.1` `2.0.2`

Also listed as affected (53)

Description

Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but the attack complexity is high.

GHSA-wh4m-6rh3-p4rq

Affected versions

magento/community-edition Packagist

magento/project-community-edition Packagist

Description

References