What is GHSA-mr8q-7f5j-wc79?

GHSA-mr8q-7f5j-wc79 is a security advisory published by GitHub Security Advisories with Low severity. Magento information disclosure vulnerability

Which CVE IDs does GHSA-mr8q-7f5j-wc79 cover?

GHSA-mr8q-7f5j-wc79 covers the following CVE IDs: CVE-2020-24406. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mr8q-7f5j-wc79?

GHSA-mr8q-7f5j-wc79 has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-mr8q-7f5j-wc79?

GHSA-mr8q-7f5j-wc79 affects 2 products, including: composer/magento/community-edition:\u003c 2.3.6; composer/magento/community-edition:= 2.4.0.

GHSA-mr8q-7f5j-wc79LowCVSS 3.7

Magento information disclosure vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 11, 2024

🔗 CVE IDs covered (1)

CVE-2020-24406 →

📋 Description

When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.

🎯 Affected products2

composer/magento/community-edition:< 2.3.6
composer/magento/community-edition:= 2.4.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-24406
https://helpx.adobe.com/security/products/magento/apsb20-59.html
https://github.com/advisories/GHSA-mr8q-7f5j-wc79