What is CVE-2020-24400?

CVE-2020-24400 is a high-severity vulnerability in Adobe Magento Commerce, classified under SQL Injection. CVSS score: 7.1/10. Published 2020-11-09.

How severe is CVE-2020-24400?

High severity. CVSS v3 base score is 7.1 out of 10.

SQL Injection in Adobe Magento Commerce

CVE-2020-24400

Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.

Vulnerability class: SQL Injection

EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

Affected products

Adobe Magento Commerce — versions unspecified
Magento — versions 2.3.5, 2.4.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@adobe.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-24400?: CVE-2020-24400 is a high-severity vulnerability in Adobe Magento Commerce, classified under SQL Injection. CVSS score: 7.1/10. Published 2020-11-09.
How severe is CVE-2020-24400?: High severity. CVSS v3 base score is 7.1 out of 10.