CVE-2020-24400: SQL injection allows arbitrary read from database
First published: Thu Oct 15 2020(Updated: )
Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/community-edition | =2.4.0 | 2.4.1 |
| composer/magento/community-edition | <2.3.6 | 2.3.6 |
| CentOS Libgcc | <2.3.5 | |
| CentOS Libgcc | <2.3.5 | |
| CentOS Libgcc | =2.3.5 | |
| CentOS Libgcc | =2.3.5 | |
| CentOS Libgcc | =2.4.0 | |
| CentOS Libgcc | =2.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-24400?
CVE-2020-24400 refers to an SQL Injection vulnerability in Magento versions 2.4.0 and 2.3.5 (and earlier) that could allow an authenticated user to access sensitive information from the database.
What is the severity of CVE-2020-24400?
The severity of CVE-2020-24400 is rated as high with a CVSS score of 7.1.
How does CVE-2020-24400 affect Magento?
CVE-2020-24400 affects Magento versions 2.4.0 and 2.3.5 (and earlier), potentially allowing an authenticated user with permissions to the product listing page to read data from the database.
How can the SQL Injection vulnerability in Magento be exploited?
The SQL Injection vulnerability in Magento can be exploited by an authenticated user with permissions to the product listing page to execute arbitrary SQL queries and retrieve sensitive information.
Is there a fix available for CVE-2020-24400?
Yes, a fix is available for CVE-2020-24400. It is recommended to update Magento to versions 2.4.1 or 2.3.6 (or later) to mitigate the vulnerability.
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pf6w-3pfw-fxvw
- alias/CVE-2020-24400
- agent/software-canonical-lookup
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/magento
- canonical/centos libgcc
- version/centos libgcc/2.3.5
- version/centos libgcc/2.4.0