CVE-2020-9689 - Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability

Back Back to CVE browser

MEDIUM

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability

Published Jul 29, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 4.14%

Description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected products

Vendor Adobe Product Magento Default
n/a
- Version
  2.3.5-p1 and earlier, and 2.3.5-p1 and earlier versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Adobe

Magento

n/a

Version	Status	Constraints
2.3.5-p1 and earlier, and 2.3.5-p1 and earlier versions	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

Link	Providers	Tags
https://github.com/advisories/GHSA-fr6f-xmfx-rrpq		Advisory
https://github.com/magento/magento2/commit/9436781734e47c83e96977fa770d255217680d5e#diff-7c7399d1d47cdaf120a1a503b7ad87f496d98790203dc82b395ec6bc2d430a55
https://helpx.adobe.com/security/products/magento/apsb20-47.html		x_refsource_CONFIRMPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9689