What is GHSA-pf6w-3pfw-fxvw?

GHSA-pf6w-3pfw-fxvw is a security advisory published by GitHub Security Advisories with High severity. Magento SQL Injection vulnerability

Which CVE IDs does GHSA-pf6w-3pfw-fxvw cover?

GHSA-pf6w-3pfw-fxvw covers the following CVE IDs: CVE-2020-24400. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pf6w-3pfw-fxvw?

GHSA-pf6w-3pfw-fxvw has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-pf6w-3pfw-fxvw?

GHSA-pf6w-3pfw-fxvw affects 2 products, including: composer/magento/community-edition:\u003c 2.3.6; composer/magento/community-edition:= 2.4.0.

GHSA-pf6w-3pfw-fxvwHighCVSS 7.1

Magento SQL Injection vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 11, 2024

🔗 CVE IDs covered (1)

CVE-2020-24400 →

📋 Description

Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.

🎯 Affected products2

composer/magento/community-edition:< 2.3.6
composer/magento/community-edition:= 2.4.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-24400
https://helpx.adobe.com/security/products/magento/apsb20-59.html
https://github.com/advisories/GHSA-pf6w-3pfw-fxvw