CVE-2024-20720

CRITICAL EXPLOITED IN THE WILD

Adobe Commerce <2.4.6-p3, 2.4.5-p5, 2.4.4-p6 - Code Injection

Title source: llm

Exploitation Summary

CVE-2024-20720 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://helpx.adobe.com/security/products/magento/apsb24-03.html

Scores

CVSS v3 9.1

EPSS 0.0720

EPSS Percentile 91.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

VulnCheck KEV 2024-04-04

InTheWild.io 2024-04-04

CWE

CWE-78

Status published

Products (5)

adobe/commerce 2.4.4 (7 CPE variants)

adobe/commerce 2.4.5 (6 CPE variants)

adobe/commerce 2.4.6 (4 CPE variants)

magento/community-edition Packagist

magento/project-community-edition 0Packagist

Published Feb 15, 2024

Tracked Since Feb 18, 2026