PT-2020-6380 · Adobe · Magento

Published 2020-04-28 · Updated 2024-03-06 · CVE-2020-9588

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento versions 1.14.4.4 and earlier Magento versions 1.9.4.4 and earlier

Description The issue is related to an observable timing discrepancy, which could allow a remote attacker to gain unauthorized access to protected information. This discrepancy may lead to a signature verification bypass.

Recommendations For Magento versions 2.3.4 and earlier, update to a version later than 2.3.4 to resolve the issue. For Magento versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue. For Magento versions 1.14.4.4 and earlier, update to a version later than 1.14.4.4 to resolve the issue. For Magento versions 1.9.4.4 and earlier, update to a version later than 1.9.4.4 to resolve the issue.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BDU:2021-04357

BIT-MAGENTO-2020-9588

CVE-2020-9588

GHSA-J2R4-2CR6-H3R3

Affected Products

Magento

References · 6

• https://osv.dev/vulnerability/BIT-magento-2020-9588 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-22.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j2r4-2cr6-h3r3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9588 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04357 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-9588 · Security Note