by Kastro
Paper/Archive/CVE-2024-20720

CVE-2024-20720

Adobe Adobe Commerce — Command injection in data collector backup due to insufficient patching of CVE-2023-38208

EPSS 4%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 89.7.897 × 2017.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

Affected

ProductAffectedFixed inSource
Adobe Commerce≤ 2.4.4-p6–CNA
commerce≤ 2.4.6-p3–CISA-ADP
commerce≤ 2.4.5-p5–CISA-ADP
commerce≤ 2.4.4-p6–CISA-ADP
commerce≤ 2.4.3-ext-5–CISA-ADP
commerce≤ 2.4.2-ext-5–CISA-ADP
commerce≤ 2.4.1-ext-5–CISA-ADP
commerce≤ 2.4.0-ext-5–CISA-ADP
commerce≤ 2.3.7-p4-ext-5–CISA-ADP
commerce≤ 2.4.6-p3–CISA-ADP
commerce≤ 2.4.5-p5–CISA-ADP
commerce≤ 2.4.4-p6–CISA-ADP

Scores by source

adobe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/magento/apsb24-03.html