CVE-2024-39406: Magento Open Source Path Traversal vulnerability
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
Other sources
Magento Open Source Path Traversal vulnerability
— Packagist
Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.4-p10 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p9 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p7 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39406?
CVE-2024-39406 is considered a critical vulnerability due to its potential to allow arbitrary file system read access.
How do I fix CVE-2024-39406?
To fix CVE-2024-39406, upgrade to Adobe Commerce versions 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, or 2.4.7-p2.
Who is affected by CVE-2024-39406?
CVE-2024-39406 affects users of Adobe Commerce versions 2.4.4 through 2.4.7-p1.
What does CVE-2024-39406 exploit?
CVE-2024-39406 exploits an improper limitation of a pathname to a restricted directory, enabling path traversal.
What are the potential impacts of CVE-2024-39406?
The potential impacts of CVE-2024-39406 include exposure of sensitive files and data compromise if exploited.