GHSA-rr59-pjwj-6grj

Magento sql injection vulnerability

At a glance

Published: 2022-05-24 17:07 UTC
Updated: 2024-03-06 12:28 UTC
CVE: CVE-2020-3719
Aliases: BIT-magento-2020-3719
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

Affected packages

Package	Versions
Packagist · magento/community-edition	introduced 2.3.0, fixed 2.3.4
Packagist · magento/community-edition	introduced 0, fixed 2.2.11
Packagist · magento/core	introduced 0, fixed 1.9.4.4

References

https://nvd.nist.gov/vuln/detail/CVE-2020-3719 ADVISORY
https://github.com/magento/magento2 PACKAGE
https://helpx.adobe.com/security/products/magento/apsb20-02.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database