CVE-2024-20758: Magento Open Source allows Improper Input Validation

April 10, 2024 (updated March 4, 2025)

Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but the attack complexity is high.

References

github.com/advisories/GHSA-wh4m-6rh3-p4rq
github.com/magento/magento2
helpx.adobe.com/security/products/magento/apsb24-18.html
nvd.nist.gov/vuln/detail/CVE-2024-20758

Code Behaviors & Features

Detect and mitigate CVE-2024-20758 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →