CVE-2020-24406 — Sensitive Information Exposure in Magento Community-edition

CWE-200 — Sensitive Information ExposureCWE-22 — Path Traversal4 documents4 sources
Severity
3.7LOWNVD
EPSS
0.3%
top 47.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Magento Community-editionAdobe Magento CommerceMagento
Timeline
PublishedNov 9
Latest updateMay 24

Description

When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages3 packages

▶Packagistmagento/community-edition2.4.0 — 2.4.1+1
▶NVDmagento/magento2.3.4+1
▶CVEListV5adobe/magento_commerceunspecified — 2.4.0+2

🔴Vulnerability Details

3
OSV
Magento information disclosure vulnerability↗2022-05-24
▶
GHSA
Magento information disclosure vulnerability↗2022-05-24
▶
CVEList
Document root path disclosure on Maintenance page↗2020-11-09
▶
CVE-2020-24406 — Sensitive Information Exposure | cvebase