CVE-2020-24406CWE-200

Document root path disclosure on Maintenance page

Low · published November 9, 2020

CVSS v3.1
3.7
EPSS
2%
Percentile
81.3
In the wild
Unconfirmed
What it is

When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02078 · 81.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2020-11-09T00:39Z
EPSS history
Timeline
  • 09 NOV 00:39Z
    Document root path disclosure on Maintenance page
    cvelistv5