PT-2020-6326 · Adobe · Magento

Published 2020-06-26 · Updated 2024-03-06 · CVE-2020-9581

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento versions 1.14.4.4 and earlier Magento versions 1.9.4.4 and earlier

Description The issue is related to a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. The vulnerability is associated with the lack of protection of the web page structure, which could allow a remote attacker to perform cross-site scripting attacks.

Recommendations For Magento versions 2.3.4 and earlier, update to a version later than 2.3.4 to resolve the issue. For Magento versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue. For Magento versions 1.14.4.4 and earlier, update to a version later than 1.14.4.4 to resolve the issue. For Magento versions 1.9.4.4 and earlier, update to a version later than 1.9.4.4 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04187

BIT-MAGENTO-2020-9581

CVE-2020-9581

GHSA-2W2X-7QGJ-4X78

Affected Products

Magento

References · 8

• https://helpx.adobe.com/security/products/magento/apsb20-22.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2w2x-7qgj-4x78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9581 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9581 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-9581 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04187 · Security Note
• https://github.com/magento/magento2 · Note
• https://github.com/magento/magento2/commit/52d92dbd07f09620d23693ba0c4d4bdb4ba09916 · Note