CVE-2024-20720
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
- Record
CVE-2024-20720- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2024-18435
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
- Record
EUVD-2024-18435- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-525f-pvj5-vqmq
Magento Open Source allows OS Command Injection
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
- Record
GHSA-525f-pvj5-vqmq- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
- Record
CVE-2024-20720- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
- Record
CVE-2024-20720- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-525f-pvj5-vqmq
Magento Open Source allows OS Command Injection
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
- Record
GHSA-525f-pvj5-vqmq- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist | 2.4.6 to 2.4.6 | None known |
magento/community-editionPackagist | 2.4.5 to 2.4.5 | None known |
magento/community-editionPackagist | 2.4.4 to 2.4.4 | None known |
magento/community-editionPackagist | 2.4.6-p1 up to 2.4.6-p4 | 2.4.6-p4 |
magento/community-editionPackagist | 2.4.5-p1 up to 2.4.5-p6 | 2.4.5-p6 |
magento/community-editionPackagist | 2.4.4-p1 up to 2.4.4-p7 | 2.4.4-p7 |
magento/project-community-editionPackagist | through 2.0.2 | None known |
magento/community-editionPackagist | Listed versions 2.4.6 | None known |
magento/community-editionPackagist | Listed versions 2.4.5 | None known |
magento/community-editionPackagist | Listed versions 2.4.4 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist | 2.4.6-p1 up to 2.4.6-p4, plus listed versions 2.4.6-p22.4.6-p3 | 2.4.6-p4 |
magento/community-editionPackagist | 2.4.5-p1 up to 2.4.5-p6, plus listed versions 2.4.5-p22.4.5-p32.4.5-p42.4.5-p5 | 2.4.5-p6 |
magento/community-editionPackagist | 2.4.4-p1 up to 2.4.4-p7, plus listed versions 2.4.4-p22.4.4-p32.4.4-p42.4.4-p52.4.4-p6 | 2.4.4-p7 |
magento/project-community-editionPackagist | through 2.0.2, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta2.0.02.0.0-rc | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-20720 is a critical vulnerability (CVSS 9.1) in Adobe Commerce, published February 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.69%, the 89th percentile. Fixed in magento/community-edition 2.4.6-p4.
References
Left out here: 2 versions. The JSON record has them.