GitHub Advisoryadvisory · Packagist

GHSA-8wm7-h2qh-ff4c Magento authorization bypass vulnerability

HIGH Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2020-9587
Ecosystem
Packagist
Packages
magento/community-edition, magento/core, magento/project-community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-863
Reviewed
2024-01-11

Affected packages

• Packagist magento/community-edition: <= 2.2.11 (no fix yet) • Packagist magento/community-edition: >= 2.3.0, < 2.3.4-p2 → fixed in 2.3.4-p2 • Packagist magento/core: < 1.9.4.5 → fixed in 1.9.4.5 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.

Related

Alias · CVE (1)

  • CVE-2020-9587 Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References