VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Oct 16, 2020· Updated Jun 17, 2026

CVE-2020-24408

CVE-2020-24408

Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
magento/community-editionPackagist
< 2.4.12.4.1

Affected products

11
  • Magento/Magento8 versions
    cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*+ 7 more
    • cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*range: <=2.3.4
    • cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*range: <=2.3.4
    • cpe:2.3:a:magento:magento:2.3.5:-:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.3.5:-:*:*:open_source:*:*:*
    • cpe:2.3:a:magento:magento:2.3.5:p1:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.3.5:p1:*:*:open_source:*:*:*
    • cpe:2.3:a:magento:magento:2.4.0:*:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.4.0:*:*:*:open_source:*:*:*
  • osv-coords2 versions
    pkg:bitnami/magentopkg:composer/magento/community-edition
    < 2.3.6+ 1 more
    • (no CPE)range: < 2.3.6
    • (no CPE)range: < 2.4.1
  • Adobe Inc./Magento Commercecpe-rescue
    Range: unspecified

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.