Lucene search

GoogleOSV:BIT-MAGENTO-2020-24407

HistoryMar 06, 2024 - 11:07 a.m.

BIT-magento-2020-24407

2024-03-0611:07:21

Google

osv.dev

magento

version

unsafe

file upload

vulnerability

arbitrary code execution

authenticated users

administrative permissions

system/data

transfer/import components

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

0.001

Percentile

36.3%

JSON

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.