GHSA-g7pc-799q-743f

Magento DOM-based Cross-site scripting vulnerability

At a glance

Published: 2022-05-24 17:24 UTC
Updated: 2025-02-10 20:42 UTC
CVE: CVE-2020-9691
Aliases: BIT-magento-2020-9691
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected packages

Package	Versions
Packagist · magento/community-edition	introduced 0, fixed 2.3.5-p2
Packagist · magento/project-community-edition	introduced 0, last affected 2.0.2

References

https://nvd.nist.gov/vuln/detail/CVE-2020-9691 ADVISORY
https://github.com/magento/magento2/commit/9436781734e47c83e96977fa770d255217680d5e WEB
https://github.com/magento/magento2 PACKAGE
https://helpx.adobe.com/security/products/magento/apsb20-47.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database