GHSA-8wm7-h2qh-ff4c
Magento authorization bypass vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2020-9587
- Alias
- BIT-magento-2020-9587
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 0, last affected 2.2.11 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.4-p2 |
| Packagist · magento/core | introduced 0, fixed 1.9.4.5 |
| Packagist · magento/project-community-edition | introduced 0, last affected 2.0.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2020-9587 ADVISORY
- https://github.com/magento/magento2 PACKAGE
- https://helpx.adobe.com/security/products/magento/apsb20-22.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |