Threats tagged 'ghsa-2ff6-837j-hg5x'

Magento Project Community Edition versions up to 2.4.7-p1 and several earlier patch versions contain an OS Command Injection vulnerability (CVE-2024-39402). This flaw allows an authenticated admin user to execute arbitrary OS commands, potentially leading to full system compromise. Exploitation requires user interaction and elevated privileges. The vulnerability has a high severity with a CVSS score of 8.4. Fixed versions have been released for all affected branches.