Adobe Commerce | Improper Input Validation (CWE-20)

The vulnerability identified as CVE-2024-20758 affects Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3, and earlier [1]. The root cause is an Improper Input Validation flaw, which can be leveraged to achieve arbitrary code execution on the underlying filesystem [1].

Exploitation does not require user interaction, but the attack complexity is high according to the advisory [1]. The official description and NVD entry do not detail a specific attack vector, but the reference to the Magento source repository [2] suggests that the flaw likely resides in core input-handling logic within the application.

Successful exploitation could allow an attacker to execute arbitrary commands or place malicious files on the server, potentially leading to full compromise of the Adobe Commerce instance and associated data [1]. The high attack complexity may limit widespread exploitation, but the impact on confidentiality, integrity, and availability is severe.

Adobe has not released a patch at the time of publication; users should monitor official channels for security updates and consider applying available workarounds or using a web application firewall to mitigate risk [1]. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.