by Kastro
Paper/Archive/CVE-2020-24407

CVE-2020-24407

Adobe Magento Commerce — Arbitrary code execution via file import functionality

EPSS 5%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 92.6.926 × 2018.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

Affected

ProductAffectedFixed inSource
Magento Commerceunspecified – 2.4.0–CNA
Magento Commerceunspecified – 2.3.5p1–CNA
Magento Commerceunspecified – None–CNA

Scores by source

adobe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/magento/apsb20-59.html