{"id":"CVE-2024-20720","published":"2024-02-15T13:39:37Z","modified":"2025-12-16T18:13:19Z","title":"Command injection in data collector backup due to insufficient patching of CVE-2023-38208","vendor":"Adobe","product":"Adobe Commerce","tier":"core","eol":null,"affectedVersions":[{"vendor":"Adobe","product":"Adobe Commerce","versions":["<= 2.4.4-p6"]}],"description":{"text":"Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03687,"percentile":0.8967,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-04-04","exploitedFirstSeen":"2024-04-04","ransomware":false,"evidence":[{"url":"https://sansec.io/research/magento-xml-backdoor","date":"2024-04-04"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-state-of-magecart-a-persistent-threat-to-e-commerce-security/","date":"2025-01-09"},{"url":"https://www.group-ib.com/blog/fingerprint-heists/","date":"2025-02-20"},{"url":"https://falconfeeds.io/blogs/unmasking-handala-iran-cyber-threat-psyops","date":"2025-06-16"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":7,"pulses":[{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"Double Umbrella AS15169/AS21928: This evaluates a critical structural convergence between Google (AS15169) and T-Mobile USA (AS21928) within the global Tier-1 routing backbone","url":"https://otx.alienvault.com/pulse/698d30c03b57c38dff915023","created":"2026-02-12"},{"name":"The State of Magecart: A Persistent Threat to E-Commerce Security","url":"https://otx.alienvault.com/pulse/67869ca0f709b648d61a7dbb","created":"2025-01-14"},{"name":"Persistent Magento backdoor hidden in XML","url":"https://otx.alienvault.com/pulse/66155c206080da1a7f2e92c3","created":"2024-04-09"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb24-03.html","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.6-p1, <2.4.6-p4",">=2.4.5-p1, <2.4.5-p6",">=2.4.4-p1, <2.4.4-p7"],"patched":["2.4.6-p4","2.4.5-p6","2.4.4-p7"],"from":["GHSA-525f-pvj5-vqmq"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-525f-pvj5-vqmq"],"provenance":"source"}],"advisories":[{"id":"GHSA-525f-pvj5-vqmq","url":"https://github.com/advisories/GHSA-525f-pvj5-vqmq","severity":"HIGH","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-525f-pvj5-vqmq","url":"https://github.com/advisories/GHSA-525f-pvj5-vqmq","severity":"HIGH","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-525f-pvj5-vqmq","url":"https://github.com/advisories/GHSA-525f-pvj5-vqmq","severity":"HIGH","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-525f-pvj5-vqmq","url":"https://github.com/advisories/GHSA-525f-pvj5-vqmq","severity":"HIGH","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.6-p1, <2.4.6-p4"],"patched":["2.4.6-p4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-525f-pvj5-vqmq","url":"https://github.com/advisories/GHSA-525f-pvj5-vqmq","severity":"HIGH","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.5-p1, <2.4.5-p6"],"patched":["2.4.5-p6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-525f-pvj5-vqmq","url":"https://github.com/advisories/GHSA-525f-pvj5-vqmq","severity":"HIGH","ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.4-p1, <2.4.4-p7"],"patched":["2.4.4-p7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-525f-pvj5-vqmq","url":"https://github.com/advisories/GHSA-525f-pvj5-vqmq","severity":"HIGH","ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-18435","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-18435","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-02-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-20720","provenance":"source"},{"date":"2024-04-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://sansec.io/research/magento-xml-backdoor","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":61.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 939 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.93,"detail":"percentile 0.8967"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}