VYPR
← All advisories
High severity8.4NVD Advisory· Published Aug 14, 2024· Updated Jun 17, 2026

CVE-2024-39401

CVE-2024-39401

Description

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
magento/project-community-editionPackagist
<= 2.0.2—
magento/community-editionPackagist
>= 2.4.7-beta1, < 2.4.7-p22.4.7-p2
magento/community-editionPackagist
>= 2.4.6-p1, < 2.4.6-p72.4.6-p7
magento/community-editionPackagist
>= 2.4.5-p1, < 2.4.5-p92.4.5-p9
magento/community-editionPackagist
>= 2.4.4-p1, < 2.4.4-p102.4.4-p10

Affected products

65
  • ghsa-coords2 versions
    pkg:composer/magento/project-community-editionpkg:composer/magento/community-edition
    <= 2.0.2+ 1 more
    • (no CPE)range: <= 2.0.2
    • (no CPE)range: >= 2.4.7-beta1, < 2.4.7-p2
  • Adobe Inc./Commercecpe-rescue32 versions
    0+ 31 more
    • (no CPE)range: 0
    • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*range: <=2.4.3
    • cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.6:p4:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.6:p6:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.7:b1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.7:b2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.7:p1:*:*:*:*:*:*
  • Adobe Inc./Magento31 versions
    cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*+ 30 more
    • cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*range: <=2.4.3
    • cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.4:p9:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.5:p8:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.6:p6:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.7:-:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.7:b2:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.7:p1:*:*:open_source:*:*:*

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.