CVE-2024-39406: Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
First published: Wed Aug 14 2024(Updated: )
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/community-edition | =2.4.4 | |
| composer/magento/community-edition | <2.4.4-p10 | 2.4.4-p10 |
| composer/magento/community-edition | =2.4.5 | |
| composer/magento/community-edition | >=2.4.5-p1<2.4.5-p9 | 2.4.5-p9 |
| composer/magento/community-edition | =2.4.6 | |
| composer/magento/community-edition | >=2.4.6-p1<2.4.6-p7 | 2.4.6-p7 |
| composer/magento/community-edition | =2.4.7 | |
| composer/magento/community-edition | >=2.4.7-p1<2.4.7-p2 | 2.4.7-p2 |
| Adobe Magento Commerce | <=2.4.3 | |
| Adobe Magento Commerce | =2.4.4 | |
| Adobe Magento Commerce | =2.4.4-p1 | |
| Adobe Magento Commerce | =2.4.4-p2 | |
| Adobe Magento Commerce | =2.4.4-p3 | |
| Adobe Magento Commerce | =2.4.4-p4 | |
| Adobe Magento Commerce | =2.4.4-p5 | |
| Adobe Magento Commerce | =2.4.4-p6 | |
| Adobe Magento Commerce | =2.4.4-p7 | |
| Adobe Magento Commerce | =2.4.4-p8 | |
| Adobe Magento Commerce | =2.4.4-p9 | |
| Adobe Magento Commerce | =2.4.5 | |
| Adobe Magento Commerce | =2.4.5-p1 | |
| Adobe Magento Commerce | =2.4.5-p2 | |
| Adobe Magento Commerce | =2.4.5-p3 | |
| Adobe Magento Commerce | =2.4.5-p4 | |
| Adobe Magento Commerce | =2.4.5-p5 | |
| Adobe Magento Commerce | =2.4.5-p6 | |
| Adobe Magento Commerce | =2.4.5-p7 | |
| Adobe Magento Commerce | =2.4.5-p8 | |
| Adobe Magento Commerce | =2.4.6 | |
| Adobe Magento Commerce | =2.4.6-p1 | |
| Adobe Magento Commerce | =2.4.6-p2 | |
| Adobe Magento Commerce | =2.4.6-p3 | |
| Adobe Magento Commerce | =2.4.6-p4 | |
| Adobe Magento Commerce | =2.4.6-p5 | |
| Adobe Magento Commerce | =2.4.6-p6 | |
| Adobe Magento Commerce | =2.4.7 | |
| Adobe Magento Commerce | =2.4.7-b1 | |
| Adobe Magento Commerce | =2.4.7-b2 | |
| Adobe Magento Commerce | =2.4.7-p1 | |
| Magento | <=2.4.3 | |
| Magento | =2.4.4 | |
| Magento | =2.4.4-p1 | |
| Magento | =2.4.4-p2 | |
| Magento | =2.4.4-p3 | |
| Magento | =2.4.4-p4 | |
| Magento | =2.4.4-p5 | |
| Magento | =2.4.4-p6 | |
| Magento | =2.4.4-p7 | |
| Magento | =2.4.4-p8 | |
| Magento | =2.4.4-p9 | |
| Magento | =2.4.5 | |
| Magento | =2.4.5-p1 | |
| Magento | =2.4.5-p2 | |
| Magento | =2.4.5-p3 | |
| Magento | =2.4.5-p4 | |
| Magento | =2.4.5-p5 | |
| Magento | =2.4.5-p6 | |
| Magento | =2.4.5-p7 | |
| Magento | =2.4.5-p8 | |
| Magento | =2.4.6 | |
| Magento | =2.4.6-p1 | |
| Magento | =2.4.6-p2 | |
| Magento | =2.4.6-p3 | |
| Magento | =2.4.6-p4 | |
| Magento | =2.4.6-p5 | |
| Magento | =2.4.6-p6 | |
| Magento | =2.4.7 | |
| Magento | =2.4.7-b1 | |
| Magento | =2.4.7-b2 | |
| Magento | =2.4.7-p1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-39406?
CVE-2024-39406 is considered a critical vulnerability due to its potential to allow arbitrary file system read access.
How do I fix CVE-2024-39406?
To fix CVE-2024-39406, upgrade to Adobe Commerce versions 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, or 2.4.7-p2.
Who is affected by CVE-2024-39406?
CVE-2024-39406 affects users of Adobe Commerce versions 2.4.4 through 2.4.7-p1.
What does CVE-2024-39406 exploit?
CVE-2024-39406 exploits an improper limitation of a pathname to a restricted directory, enabling path traversal.
What are the potential impacts of CVE-2024-39406?
The potential impacts of CVE-2024-39406 include exposure of sensitive files and data compromise if exploited.
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/title
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6pxh-2557-5cj5
- alias/CVE-2024-39406
- agent/software-canonical-lookup
- agent/references
- agent/description
- agent/event
- agent/author
- collector/github-advisory
- agent/last-modified-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/composer
- vendor/adobe
- canonical/adobe magento commerce
- version/adobe magento commerce/2.4.3
- version/adobe magento commerce/2.4.4
- version/adobe magento commerce/2.4.4-p1
- version/adobe magento commerce/2.4.4-p2
- version/adobe magento commerce/2.4.4-p3
- version/adobe magento commerce/2.4.4-p4
- version/adobe magento commerce/2.4.4-p5
- version/adobe magento commerce/2.4.4-p6
- version/adobe magento commerce/2.4.4-p7
- version/adobe magento commerce/2.4.4-p8
- version/adobe magento commerce/2.4.4-p9
- version/adobe magento commerce/2.4.5
- version/adobe magento commerce/2.4.5-p1
- version/adobe magento commerce/2.4.5-p2
- version/adobe magento commerce/2.4.5-p3
- version/adobe magento commerce/2.4.5-p4
- version/adobe magento commerce/2.4.5-p5
- version/adobe magento commerce/2.4.5-p6
- version/adobe magento commerce/2.4.5-p7
- version/adobe magento commerce/2.4.5-p8
- version/adobe magento commerce/2.4.6
- version/adobe magento commerce/2.4.6-p1
- version/adobe magento commerce/2.4.6-p2
- version/adobe magento commerce/2.4.6-p3
- version/adobe magento commerce/2.4.6-p4
- version/adobe magento commerce/2.4.6-p5
- version/adobe magento commerce/2.4.6-p6
- version/adobe magento commerce/2.4.7
- version/adobe magento commerce/2.4.7-b1
- version/adobe magento commerce/2.4.7-b2
- version/adobe magento commerce/2.4.7-p1
- canonical/magento
- version/magento/2.4.3
- version/magento/2.4.4
- version/magento/2.4.4-p1
- version/magento/2.4.4-p2
- version/magento/2.4.4-p3
- version/magento/2.4.4-p4
- version/magento/2.4.4-p5
- version/magento/2.4.4-p6
- version/magento/2.4.4-p7
- version/magento/2.4.4-p8
- version/magento/2.4.4-p9
- version/magento/2.4.5
- version/magento/2.4.5-p1
- version/magento/2.4.5-p2
- version/magento/2.4.5-p3
- version/magento/2.4.5-p4
- version/magento/2.4.5-p5
- version/magento/2.4.5-p6
- version/magento/2.4.5-p7
- version/magento/2.4.5-p8
- version/magento/2.4.6
- version/magento/2.4.6-p1
- version/magento/2.4.6-p2
- version/magento/2.4.6-p3
- version/magento/2.4.6-p4
- version/magento/2.4.6-p5
- version/magento/2.4.6-p6
- version/magento/2.4.7
- version/magento/2.4.7-b1
- version/magento/2.4.7-b2
- version/magento/2.4.7-p1