CVE-2024-20720

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb24-03.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:commerce:2.4.4:-::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p6::::::
	cpe:2.3:a:adobe:commerce:2.4.5:-::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.6:-::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p3::::::

History

16 Feb 2024, 20:14

Type	Values Removed	Values Added
Summary		(es) Las versiones 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 y anteriores de Adobe Commerce se ven afectadas por una neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando del sistema operativo ('inyección de comando del sistema operativo') eso podría provocar la ejecución de código arbitrario por parte de un atacante. La explotación de este problema no requiere la interacción del usuario.
CPE		cpe:2.3:a:adobe:commerce:2.4.6:p1:::::: cpe:2.3:a:adobe:commerce:2.4.4:-:::::: cpe:2.3:a:adobe:commerce:2.4.5:p1:::::: cpe:2.3:a:adobe:commerce:2.4.5:p4:::::: cpe:2.3:a:adobe:commerce:2.4.6:-:::::: cpe:2.3:a:adobe:commerce:2.4.5:-:::::: cpe:2.3:a:adobe:commerce:2.4.4:p2:::::: cpe:2.3:a:adobe:commerce:2.4.4:p4:::::: cpe:2.3:a:adobe:commerce:2.4.6:p3:::::: cpe:2.3:a:adobe:commerce:2.4.4:p5:::::: cpe:2.3:a:adobe:commerce:2.4.5:p5:::::: cpe:2.3:a:adobe:commerce:2.4.4:p1:::::: cpe:2.3:a:adobe:commerce:2.4.5:p3:::::: cpe:2.3:a:adobe:commerce:2.4.5:p2:::::: cpe:2.3:a:adobe:commerce:2.4.4:p3:::::: cpe:2.3:a:adobe:commerce:2.4.4:p6:::::: cpe:2.3:a:adobe:commerce:2.4.6:p2::::::
References	~~() https://helpx.adobe.com/security/products/magento/apsb24-03.html -~~	() https://helpx.adobe.com/security/products/magento/apsb24-03.html - Vendor Advisory
First Time		Adobe commerce Adobe

15 Feb 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-15 14:15

Updated : 2024-02-16 20:14

NVD link : CVE-2024-20720

Mitre link : CVE-2024-20720

CVE.ORG link : CVE-2024-20720

JSON object : View

Products Affected

adobe

commerce

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

9.1 /10