Vulnerability advisory

CVE-2020-9584

Published Jun 26, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2020-9584GHSA-45h4-6gcj-6hwv

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
239bfc72e116f6814ff6c2f6731f0830f3bcf61c through 5cfffdd1b2c6bd7cef8c07226b09da8c92d519a7	No fix listed
75da24b3b0fb950648d00e7454dae0bb7da64c30 through 5cfffdd1b2c6bd7cef8c07226b09da8c92d519a7	No fix listed
Also listed as affected (12) `2.3.0` `2.2.7` `2.1.16` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17`
GIT github.com/magento/magento2 ↗
07465f8ce879ff0bd0ba72a662c9e2473e49afe4 through 59113891b12412626f5b50d1032f6db5a089b8d4	No fix listed
f4c1d7526f05bdfb1327b0701cc345f94aadcaed through 5f3b86ab4bd3e3b94e65429fed33f748d29c1bbe	No fix listed
Also listed as affected (5) `2.3.4` `2.3.3` `2.3.2` `2.3.1` `2.3.0`

Description

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb20-22.html ↗