Back to Database
Status published
Critical
CVE-2024-20720
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Vulnerability Description
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-20720
Credits & Attribution
No credits recorded in the NVD database.
More from Adobe
View All →CVE-2025-64899
Acrobat Reader | Out-of-bounds Read (CWE-125)
High
7.8
CVE-2025-64898
ColdFusion | Insufficiently Protected Credentials (CWE-522)
Medium
5.3
CVE-2025-64897
ColdFusion | Improper Access Control (CWE-284)
Medium
5.6
CVE-2025-64896
Creative Cloud Desktop | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379)
Medium
5.5
CVE-2025-64894
DNG SDK | Integer Overflow or Wraparound (CWE-190)
Medium
5.5
Affected Vendor
Adobe
View all reports →Affected Software
Adobe Commerce
Vulnerable Versions:
0
Timeline
Official Publish:
February 15th, 2024
Last Modified:
December 16th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H