Skip to main content

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2024-39406

Medium
6.8/10

Summary

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed. This vulnerability affects magento/community-edition package versions through 2.4.4-p9, 2.4.5 through 2.4.5-p8, 2.4.6 through 2.4.6-p6, and 2.4.7-beta1 through 2.4.7-p1.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • HIGH
  • HIGH
  • NONE

CWE-22 - Path Traversal

Path traversal (or directory traversal), is a vulnerability that allows malicious users to traverse the server's root directory, gaining access to arbitrary files and folders such as application code & data, back-end credentials, and sensitive operating system files. In the worst-case scenario, an attacker could potentially execute arbitrary files on the server, resulting in a denial of service attack. Such an exploit may severely impact the integrity, confidentiality, and availability of an application.

References

Advisory Timeline

  • Published