Magento Open Source allows OS Command Injection
Date: 2024-02
Affected: composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-20716
CVE-2024-20718
CVE-2024-20719
CVE-2024-20720
CWE: CWE-352
CWE-400
CWE-78
CWE-79
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.


Mitigations:

Architectural layers (MAESTRO):