PT-2020-6329 · Adobe · Magento

Published 2020-04-28 · Updated 2024-09-26 · CVE-2020-9583

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento versions 1.14.4.4 and earlier Magento versions 1.9.4.4 and earlier

Description The issue is related to a lack of data sanitization at the administrative level, which can be exploited by a remote attacker to execute arbitrary code. This can lead to arbitrary code execution, allowing the attacker to perform various malicious actions.

Recommendations For versions 2.3.4 and earlier, update to a version later than 2.3.4 to resolve the issue. For versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue. For versions 1.14.4.4 and earlier, update to a version later than 1.14.4.4 to resolve the issue. For versions 1.9.4.4 and earlier, update to a version later than 1.9.4.4 to resolve the issue.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2021-04190

BIT-MAGENTO-2020-9583

CVE-2020-9583

GHSA-C55H-7Q4J-G6RQ

Affected Products

Magento

References · 8

• https://helpx.adobe.com/security/products/magento/apsb20-22.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-9583 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-9583 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9583 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c55h-7q4j-g6rq · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cybersecurity-help.cz/vdb/SB2020043002 · Note