Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

Remediation

References

CVE-2020-24407

Related Vulnerabilities

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-1707)

WordPress Plugin Improved Product Options for WooCommerce Security Bypass (5.2.0)

Python Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2019-9947)

Joomla! Core 3.0.x Cross-Site Scripting (3.0.0 - 3.0.3)

WordPress Plugin Simple Post Cross-Site Scripting (1.1)

Severity

Critical

Classification

CVE-2020-24407 CWE-434 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities