PT-2020-6328 · Adobe · Magento

Published 2020-04-28 · Updated 2024-03-06 · CVE-2020-9591

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento version 1.14.4.4 and earlier Magento version 1.9.4.4 and earlier

Description The issue is related to insufficient access control, which could allow a remote attacker to gain unauthorized access to the admin panel. Successful exploitation of this defense-in-depth security mitigation could lead to unauthorized access.

Recommendations For Magento versions 2.3.4 and earlier, update to a version later than 2.3.4 to resolve the issue. For Magento versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue. For Magento version 1.14.4.4 and earlier, update to a version later than 1.14.4.4 to resolve the issue. For Magento version 1.9.4.4 and earlier, update to a version later than 1.9.4.4 to resolve the issue.

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

BDU:2021-04189

BIT-MAGENTO-2020-9591

CVE-2020-9591

GHSA-W7RH-9W5V-RWQJ

Affected Products

Magento

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-9591 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb20-22.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7rh-9w5v-rwqj · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04189 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9591 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-9591 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cybersecurity-help.cz/vdb/SB2020043002 · Note