PT-2024-6010 · Adobe · Commerce

Published

2024-08-13

·

Updated

2024-08-18

·

CVE-2024-39397

CVSS v3.1

9.0

Critical

VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier
Description The issue is related to an Unrestricted Upload of File with Dangerous Type, which could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file that can then be executed on the server. Exploitation of this issue does not require user interaction, but attack complexity is high and scope is changed.
Recommendations For Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier, upgrade to a version that is not affected by this vulnerability. As a temporary workaround, consider restricting file uploads to prevent malicious files from being executed on the server. Restrict access to the server to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2024-06820
CVE-2024-39397

Affected Products

Commerce