Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

Remediation

References

CVE-2020-24407

Related Vulnerabilities

WordPress Plugin Recommend to a friend Cross-Site Scripting (2.0.2)

WordPress Plugin Stop Spammers Security-Block Spam Users, Comments, Forms Cross-Site Scripting (2021.17)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1044)

Oracle HTTP Server CVE-2018-2561 Vulnerability (CVE-2018-2561)

Moodle Improper Validation of Integrity Check Value Vulnerability (CVE-2012-1170)

Severity

Critical

Classification

CVE-2020-24407 CWE-434 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities