Magento 2.4.0 Commerce Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:magento:magento:2.4.0:*:*:*:commerce:*:*:*
part: a version: 2.4.0 update: *
| Vendor | Magento (aa019b60-1c50-5218-ad20-1f4a9a786d94) |
|---|---|
| Product | Magento (6f0f93c5-be7a-5b05-986f-1521453ea442) |
| Edition | * |
| Language | * |
| Software edition | commerce |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/firegento/magento |
purl2cpe | 2026-06-01 10:18:21.416429 |
pkg:magento/project-community-edition |
purl2cpe | 2026-06-01 10:18:21.416431 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-24408 |
vulnerable | 2026-06-08 05:22:33.019391 |
Stored XSS in customer address upload feature
MEDIUM (6.1)
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.
Published: 2020-10-16T14:03:11.096Z
Updated: 2024-09-17T03:02:26.471Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24407 |
vulnerable | 2026-06-08 05:22:33.018374 |
Arbitrary code execution via file import functionality
CRITICAL (9.1)
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.
Published: 2020-11-09T00:39:56.269Z
Updated: 2024-09-16T20:16:25.237Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24406 |
vulnerable | 2026-06-08 05:22:33.017060 |
Document root path disclosure on Maintenance page
LOW (3.7)
When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.
Published: 2020-11-09T00:39:49.001Z
Updated: 2024-09-17T01:12:06.334Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24405 |
vulnerable | 2026-06-08 05:22:33.016461 |
Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data
MEDIUM (4.3)
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.
Published: 2020-11-09T00:39:43.340Z
Updated: 2024-09-16T20:22:14.104Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24404 |
vulnerable | 2026-06-08 05:22:33.015484 |
Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
LOW (2.7)
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.
Published: 2020-11-09T00:40:04.994Z
Updated: 2024-09-16T17:47:57.272Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24403 |
vulnerable | 2026-06-08 05:22:33.014723 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24402 |
vulnerable | 2026-06-08 05:22:33.013943 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24401 |
vulnerable | 2026-06-08 05:22:33.012818 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24400 |
vulnerable | 2026-06-08 05:22:33.008600 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.