VDB
BIT-magento-2024-34108
BIT-magento-2024-34108
PUBLISHED
CVSS 9.100000381469727 CRITICAL
Record from OSV · Published June 17, 2024
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| magento | Bitnami | 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 |
Risk scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | magento | 2.4.7-alpha0, 2.4.6-alpha0, 2.4.4-alpha0 |
Timeline
- Jun 17, 2024 CVE Published
- Feb 26, 2025 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln BIT-magento-2024-34108
vulnetix vdb fixes BIT-magento-2024-34108Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/BIT-magento-2024-34108/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart