Main Vulnerability Database Vulnerabilities #VU88311

Input validation error in Adobe Commerce (formerly Magento Commerce) and Magento Open Source - CVE-2024-20758

Published: April 9, 2024

Vulnerability identifier: #VU88311

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20758

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted request to the application and execute arbitrary code on the system.

Affected software

Adobe Commerce (formerly Magento Commerce)
Magento Open Source

How to mitigate CVE-2024-20758

Install updates from vendor's website.

Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.3.7-p4-ext-7, 2.4.0-ext-7, 2.4.1-ext-7, 2.4.2-ext-7, 2.4.3-ext-7, 2.4.4-p8, 2.4.5-p7, 2.4.6-p5, 2.4.7
Magento Open Source - addressed in versions 2.4.4-p8, 2.4.5-p7, 2.4.6-p5, 2.4.7

External References

https://helpx.adobe.com/security/products/magento/apsb24-18.html

Related Security Bulletins