CVE-2024-20758
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.
- Record
CVE-2024-20758- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-18473
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.
- Record
EUVD-2024-18473- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wh4m-6rh3-p4rq
Magento Open Source allows Improper Input Validation
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but the attack complexity is high.
- Record
GHSA-wh4m-6rh3-p4rq- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.
- Record
CVE-2024-20758- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.
- Record
CVE-2024-20758- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-wh4m-6rh3-p4rq
Magento Open Source allows Improper Input Validation
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but the attack complexity is high.
- Record
GHSA-wh4m-6rh3-p4rq- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVBIT-magento-2024-20758 No score
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but the attack complexity is high.
- Record
BIT-magento-2024-20758- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist |
2.4.6 to 2.4.6 | None known |
magento/community-editionPackagist |
2.4.5 to 2.4.5 | None known |
magento/community-editionPackagist |
2.4.4 to 2.4.4 | None known |
magento/community-editionPackagist |
2.4.7-beta1 to 2.4.7-beta3 | 2.4.7 |
magento/community-editionPackagist |
2.4.6-p1 up to 2.4.6-p5 | 2.4.6-p5 |
magento/community-editionPackagist |
2.4.5-p1 up to 2.4.5-p7 | 2.4.5-p7 |
magento/community-editionPackagist |
2.4.4-p1 up to 2.4.4-p8 | 2.4.4-p8 |
magento/project-community-editionPackagist |
through 2.0.2 | None known |
magentoBitnami |
2.4.7-alpha0 up to 2.4.7, 2.4.6-alpha0 up to 2.4.6-p5, 2.4.5-alpha0 up to 2.4.5-p7, 2.4.4-alpha0 up to 2.4.4-p8 | 2.4.72.4.6-p52.4.5-p72.4.4-p8 |
magento/community-editionPackagist |
Listed versions 2.4.6 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist |
Listed versions 2.4.5 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.4 |
None known |
magento/community-editionPackagist |
2.4.7-beta1 up to 2.4.7, plus listed versions 2.4.7-beta22.4.7-beta3 |
2.4.7 |
magento/community-editionPackagist |
2.4.6-p1 up to 2.4.6-p5, plus listed versions 2.4.6-p22.4.6-p32.4.6-p4 |
2.4.6-p5 |
magento/community-editionPackagist |
2.4.5-p1 up to 2.4.5-p7, plus listed versions 2.4.5-p22.4.5-p32.4.5-p42.4.5-p52.4.5-p6 |
2.4.5-p7 |
magento/community-editionPackagist |
2.4.4-p1 up to 2.4.4-p8, plus listed versions 2.4.4-p22.4.4-p32.4.4-p42.4.4-p52.4.4-p62.4.4-p7 |
2.4.4-p8 |
magento/project-community-editionPackagist |
through 2.0.2, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta2.0.02.0.0-rc |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-20758 is a critical vulnerability (CVSS 9.0) in Adobe Commerce, published April 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.42%, the 72nd percentile. Fixed in magento/community-edition 2.4.7.
References
Left out here: 2 versions. The JSON record has them.