CVE-2020-9664 - Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability

Back Back to CVE browser

CRITICAL

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability

Published Jul 22, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 8.38%

Description

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected products

Vendor Adobe Product Magento Default
n/a
- Version
  1.14.4.5 and earlier, and 1.9.4.5 and earlier versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Adobe

Magento

n/a

Version	Status	Constraints
1.14.4.5 and earlier, and 1.9.4.5 and earlier versions	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-502

Deserialization of Untrusted Data

CWE-94

Code Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2092
Advisory
https://github.com/advisories/GHSA-337c-3rch-q35j
Advisory
https://helpx.adobe.com/security/products/magento/apsb20-41.html
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9664

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2092		Advisory
https://github.com/advisories/GHSA-337c-3rch-q35j		Advisory
https://helpx.adobe.com/security/products/magento/apsb20-41.html		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9664