PT-2020-4583 · Adobe · Magento

Published 2020-10-15 · Updated 2024-03-06 · CVE-2020-24407

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.0 and 2.3.5p1 (and earlier)

Description The issue is related to an unsafe file upload vulnerability, which could result in arbitrary code execution. This could be exploited by authenticated users with administrative permissions to the System/Data and Transfer/Import components. The vulnerability is associated with a lack of restrictions on file uploads, allowing a remote attacker to execute arbitrary code.

Recommendations For Magento versions 2.4.0 and 2.3.5p1 (and earlier), consider restricting access to the System/Data and Transfer/Import components to minimize the risk of exploitation. As a temporary workaround, limit the file upload functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2020-05132

BIT-MAGENTO-2020-24407

CVE-2020-24407

GHSA-7PXG-6P87-8C9V

Affected Products

Magento

References · 11

• https://osv.dev/vulnerability/BIT-magento-2020-24407 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7pxg-6p87-8c9v · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-59.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24407 · Security Note
• https://bdu.fstec.ru/vul/2020-05132 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24407 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24407 · Note
• https://t.me/cibsecurity/15305 · Telegram Post
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24407 · Note
• https://cybersecurity-help.cz/vdb/SB2020101517 · Note