Threats tagged 'ghsa-8frp-pxq2-3gpq'

Magento project community edition versions up to certain patched releases contain an OS Command Injection vulnerability (CVE-2024-39401) that allows an admin user to execute arbitrary code. The vulnerability requires user interaction and affects multiple patched and unpatched versions prior to 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10. This flaw is due to improper neutralization of special elements in OS commands.