CVE-2020-24408: Magento

Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days.

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.

Affected products

• Magento Magento: up to and including 2.3.4; version 2.3.5 only; version 2.4.0 only

Published 2020-10-16. Last modified 2026-06-17.