CVE-2024-39406 – magento/community-edition

Package

Manager: composer
Name: magento/community-edition
Vulnerable Version: >=2.4.7-p1 <2.4.7-p2 || =2.4.7 || >=2.4.6-p1 <2.4.6-p7 || =2.4.6 || >=2.4.5-p1 <2.4.5-p9 || =2.4.5 || >=0 <2.4.4-p10 || =2.4.4

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

EPSS: 0.00537 pctl0.66562

Details

Magento Open Source Path Traversal vulnerability Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

Metadata

Created: 2024-08-14T12:35:02Z
Modified: 2024-09-16T18:26:41Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-6pxh-2557-5cj5/GHSA-6pxh-2557-5cj5.json
CWE IDs: ["CWE-22"]
Alternative ID: GHSA-6pxh-2557-5cj5
Finding: F063
Auto approve: 1