PT-2020-20730 · Adobe · Magento

Published 2020-06-26 · Updated 2024-03-06 · CVE-2020-9630

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento versions 1.14.4.4 and earlier Magento versions 1.9.4.4 and earlier

Description The issue is related to a business logic error that could lead to privilege escalation if successfully exploited.

Recommendations For Magento versions 2.3.4 and earlier, update to a version later than 2.3.4 to resolve the issue. For Magento versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue. For Magento versions 1.14.4.4 and earlier, update to a version later than 1.14.4.4 to resolve the issue. For Magento versions 1.9.4.4 and earlier, update to a version later than 1.9.4.4 to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BIT-MAGENTO-2020-9630

CVE-2020-9630

GHSA-5J4W-V87M-8R65

Affected Products

Magento

References · 6

• https://osv.dev/vulnerability/CVE-2020-9630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9630 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb20-22.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5j4w-v87m-8r65 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-9630 · Vendor Advisory
• https://github.com/magento/magento2 · Note