CVE-2020-24400

SQL injection allows arbitrary read from database

State: Published
Severity: 7.1 High
Published: Nov 9, 2020
Updated: Sep 16, 2024
Reserved: Aug 19, 2020

Description

Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	adobe

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Affected Products

Product	Versions
Magento CommerceAdobe	2.4.0 and earlierAffected 2.3.5 and earlierAffected None and earlierAffected

References

https://helpx.adobe.com/security/products/magento/apsb20-59.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.