PT-2020-6323 · Adobe · Magento

Published 2020-04-28 · Updated 2024-03-06 · CVE-2020-9578

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento versions 1.14.4.4 and earlier Magento versions 1.9.4.4 and earlier

Description The issue is related to a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. The vulnerability is also described as being related to the lack of data sanitization at the management level, which could allow a remote attacker to execute arbitrary code.

Recommendations For Magento versions 2.3.4 and earlier, update to a version later than 2.3.4 to resolve the issue. For Magento versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue. For Magento versions 1.14.4.4 and earlier, update to a version later than 1.14.4.4 to resolve the issue. For Magento versions 1.9.4.4 and earlier, update to a version later than 1.9.4.4 to resolve the issue.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2021-04184

BIT-MAGENTO-2020-9578

CVE-2020-9578

GHSA-724X-GQHV-9C5X

Affected Products

Magento

References · 7

• https://helpx.adobe.com/security/products/magento/apsb20-22.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9578 · Security Note
• https://bdu.fstec.ru/vul/2021-04184 · Security Note
• https://osv.dev/vulnerability/GHSA-724x-gqhv-9c5x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9578 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-9578 · Vendor Advisory
• https://github.com/magento/magento2/commit/52d92dbd07f09620d23693ba0c4d4bdb4ba09916 · Note