CVE-2020-24406— Document root path disclosure on Maintenance page
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-24406
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Document root path disclosure on Maintenance page
Source: NVD (National Vulnerability Database)
Vulnerability Description
When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Adobe Magento Open Source和Magento Commerce 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe Magento是美国奥多比（Adobe）公司的一套开源的PHP电子商务系统。该系统提供权限管理、搜索引擎和支付网关等功能。Magento Open Source是Magento的开源版本。Magento Commerce是Magento的商业版本。 Magento存在路径遍历漏洞，该漏洞源于不正确的授权检查。远程特权用户可以获得对其他受限制功能的未授权访问。攻击者可利用该漏洞获取敏感信息。以下产品及版本受到影响：Magento Open Source: 2.0.0, 2.0.1, 2.0.2,
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Magento Commerce | unspecified ~ 2.4.0 | - |
II. Public POCs for CVE-2020-24406
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-24406
请登录查看更多情报信息。
- https://helpx.adobe.com/security/products/magento/apsb20-59.htmlx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-24406
Same Patch Batch · Adobe · 2020-11-09 · 8 CVEs total
| CVE-2020-24407 | 9.1 CRITICAL | Arbitrary code execution via file import functionality |
| CVE-2020-24400 | 7.1 HIGH | SQL injection allows arbitrary read from database |
| CVE-2020-24401 | 6.5 MEDIUM | Incorrect permissions following the deletion of a user role or deactivation of a user |
| CVE-2020-24402 | 4.9 MEDIUM | Incorrect permissions in the Integrations component could lead to unauthorized deletion of |
| CVE-2020-24405 | 4.3 MEDIUM | Incorrect permissions in Inventory module could lead to unauthorized modification of inven |
| CVE-2020-24404 | 2.7 LOW | Incorrect permissions in Integrations component could lead to unauthorized deletion of cms |
| CVE-2020-24403 | 2.7 LOW | Incorrect permissions could lead to unauthorized modification of inventory source data via |
IV. Related Vulnerabilities
Same product: Magento Commerce
- CVE-2023-38208
Validate Your Inputs | Improper Neutralization of Special El - CVE-2023-38209
Adobe Commerce Incorrect Authorization Security feature bypa - CVE-2023-29292
Server Side Request Forgery (SSRF) in FedEx carrier integrat - CVE-2023-29297
Admin-to-admin stored XSS via cache poisoning - CVE-2023-29296
[Cloud] Customer suspects IDOR vulnerability
Same vendor: Adobe
- CVE-2026-34672
CAI Content Credentials | Integer Underflow (Wrap or Wraparo - CVE-2026-34671
CAI Content Credentials | Integer Overflow or Wraparound (CW - CVE-2026-34669
CAI Content Credentials | Improper Input Validation (CWE-20) - CVE-2026-34678
CAI Content Credentials | Uncontrolled Resource Consumption - CVE-2026-34688
CAI Content Credentials | Improper Input Validation (CWE-20)
Same weakness: CWE-200
- CVE-2025-31985
HCL BigFix Service Management (SM) is affected by a security - CVE-2026-6728
Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Infor - CVE-2026-5075
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensi - CVE-2026-34970
MantisBT Bugnote Revision Page Leaks Private Issue Metadata - CVE-2026-34744
MantisBT authorization bypass allows continued access to sel
V. Comments for CVE-2020-24406
No comments yet