GHSA-rr59-pjwj-6grj

Magento sql injection vulnerability

En bref

Publiée: 2022-05-24 17:07 UTC
Mise à jour: 2024-03-06 12:28 UTC
CVE: CVE-2020-3719
Alias: BIT-magento-2020-3719
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

Paquets affectés

Paquet	Versions
Packagist · magento/community-edition	introduced 2.3.0, fixed 2.3.4
Packagist · magento/community-edition	introduced 0, fixed 2.2.11
Packagist · magento/core	introduced 0, fixed 1.9.4.4

Références

https://nvd.nist.gov/vuln/detail/CVE-2020-3719 ADVISORY
https://github.com/magento/magento2 PACKAGE
https://helpx.adobe.com/security/products/magento/apsb20-02.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database