GHSA-8wm7-h2qh-ff4c
Magento authorization bypass vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2020-9587
- Aliases
- BIT-magento-2020-9587
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 0, last affected 2.2.11 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.4-p2 |
| Packagist · magento/core | introduced 0, fixed 1.9.4.5 |
| Packagist · magento/project-community-edition | introduced 0, last affected 2.0.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-9587 ADVISORY
- https://github.com/magento/magento2 PACKAGE
- https://helpx.adobe.com/security/products/magento/apsb20-22.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |