Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and... · CVE-2024-20720 · GitHub Advisory Database · GitHub

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and...

Critical severity Unreviewed Published Feb 15, 2024 to the GitHub Advisory Database • Updated Feb 15, 2024

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

References

Published by the National Vulnerability Database

Feb 15, 2024

Published to the GitHub Advisory Database Feb 15, 2024

Last updated Feb 15, 2024

Severity

Critical

9.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H