CVE-2020-3716 - Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability

Back Back to CVE browser

CRITICAL

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability

Published Jan 29, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 13.96%

Description

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected products

Vendor Adobe Product Magento Default
unknown
Affected
- 1.14.4.3 and earlier
- 1.9.4.3 and earlier versions
- 2.2.10 and earlier
- 2.3.3 and earlier

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Adobe	Magento	unknown	Affected 1.14.4.3 and earlier 1.9.4.3 and earlier versions 2.2.10 and earlier 2.3.3 and earlier

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3454
Advisory
https://github.com/advisories/GHSA-9wc9-498w-h8xv
Advisory
https://helpx.adobe.com/security/products/magento/apsb20-02.html
x_refsource_CONFIRMPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-3716

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3454		Advisory
https://github.com/advisories/GHSA-9wc9-498w-h8xv		Advisory
https://helpx.adobe.com/security/products/magento/apsb20-02.html		x_refsource_CONFIRMPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-3716