Arbitrary code execution via file import functionality (Adobe Magento Commerce)
At a glance
- Source
- NVD
- EPSS
- EPSS 5.27 % · percentile 93 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.
Weaknesses (CWE)
- CWE-434 — Unrestricted Upload of File with Dangerous Type
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | adobe |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-7pxg-6p87-8c9v — Magento 2 Community Edition RCE via Unsafe File Upload
European references
- ENISA EUVD · EUVD-2022-3044
- GCVE · GCVE-0-2020-24407
CERT-FR advisories
- CERTFR-2020-AVI-648 — Multiples vulnérabilités dans Magento · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*< 2.3.5cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*< 2.3.5cpe:2.3:a:magento:magento:2.3.5:-:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.5:-:*:*:open_source:*:*:*cpe:2.3:a:magento:magento:2.3.5:p1:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.5:p1:*:*:open_source:*:*:*cpe:2.3:a:magento:magento:2.4.0:*:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.0:*:*:*:open_source:*:*:*
Affected products
| Product | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.0 ; affected unspecified ≤ 2.3.5p1 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |