by Kastro
Paper/Archive/CVE-2024-20758

CVE-2024-20758

Adobe Adobe Commerce — Adobe Commerce | Improper Input Validation (CWE-20)

EPSS 1%CVSS 9.0
critical.is priorityof 100
42
CVSS 9.0 (CNA, NVD agree)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 72.8.728 × 2014.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.

Affected

ProductAffectedFixed inSource
Adobe Commerce≤ 2.4.7-beta3–CNA
commerce≤ 2.4.7-beta3–CISA-ADP
commerce≤ 2.4.6-p4–CISA-ADP
commerce≤ 2.4.5-p6–CISA-ADP
commerce≤ 2.4.4-p7–CISA-ADP
commerce≤ 2.4.3-ext-6–CISA-ADP
commerce≤ 2.4.2-ext-6–CISA-ADP
commerce≤ 2.4.1-ext-6–CISA-ADP
commerce≤ 2.4.0-ext-6–CISA-ADP
commerce≤ 2.3.7-p4-ext-6–CISA-ADP

Scores by source

adobe (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/magento/apsb24-18.html