PT-2020-6325 · Adobe · Magento

Published 2020-04-28 · Updated 2024-03-06 · CVE-2020-9580

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento versions 1.14.4.4 and earlier Magento versions 1.9.4.4 and earlier

Description The issue is related to incorrect code generation management in the Magento platform, which could allow a remote attacker to execute arbitrary code. Successful exploitation of this security mitigation bypass could lead to arbitrary code execution.

Recommendations For Magento versions 2.3.4 and earlier, update to a version later than 2.3.4 to resolve the issue. For Magento versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue. For Magento versions 1.14.4.4 and earlier, update to a version later than 1.14.4.4 to resolve the issue. For Magento versions 1.9.4.4 and earlier, update to a version later than 1.9.4.4 to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2021-04186

BIT-MAGENTO-2020-9580

CVE-2020-9580

GHSA-J2JP-58GV-G2PG

Affected Products

Magento

References · 9

• https://bdu.fstec.ru/vul/2021-04186 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb20-22.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-9580 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9580 · Security Note
• https://osv.dev/vulnerability/GHSA-j2jp-58gv-g2pg · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://github.com/magento/magento2/commit/52d92dbd07f09620d23693ba0c4d4bdb4ba09916 · Note
• https://snyk.io/vuln/SNYK-PHP-MAGENTOCORE-568600 · Note