CVE-2024-20720

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb24-03.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:commerce:2.4.4:-::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.4:p6::::::
	cpe:2.3:a:adobe:commerce:2.4.5:-::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p3::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p4::::::
	cpe:2.3:a:adobe:commerce:2.4.5:p5::::::
	cpe:2.3:a:adobe:commerce:2.4.6:-::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.6:p3::::::

History

No history.

Information

Published : 2024-02-15 14:15

Updated : 2024-02-16 20:14

NVD link : CVE-2024-20720

Mitre link : CVE-2024-20720

CVE.ORG link : CVE-2024-20720

JSON object : View

Products Affected

adobe

commerce

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2024-20720", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2024-02-15T14:15:46.283", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb24-03.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction."}, {"lang": "es", "value": "Las versiones 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 y anteriores de Adobe Commerce se ven afectadas por una neutralizaci\u00f3n inadecuada de elementos especiales utilizados en una vulnerabilidad de comando del sistema operativo ('inyecci\u00f3n de comando del sistema operativo') eso podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario por parte de un atacante. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario."}], "lastModified": "2024-02-16T20:14:23.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A"}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}