APSB24-61: Security update available for Adobe Commerce

APSB24-61 (published 2024-08-13) fixes 1 CVE in Adobe Commerce and Magento Open Source 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier; fixed in 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10.

Unrestricted upload of a file with a dangerous type (CVE-2024-39397) allowing arbitrary code execution by an unauthenticated attacker; Adobe notes the exploit requires the Apache web server. Fixed in the August 2024 patch set.

Published

Aug 13, 2024

Severity

critical

CVEs

1

Isolated patch

no

CVEs

Fixed in

Magento Open Source

2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10

Adobe Commerce

2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10

Mage-OS

—

References

• https://helpx.adobe.com/security/products/magento/apsb24-61.html

For integrators

Get this bulletin as JSON:

curl -s https://magento.watch/api/v1/security-bulletins/APSB24-61