DemoBook a demo

Vulnerability advisory

CVE-2020-9588

Published Updated OSV record ↗

Also known as BIT-magento-2020-9588GHSA-j2r4-2cr6-h3r3

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/magento/devdocs ↗
239bfc72e116f6814ff6c2f6731f0830f3bcf61c through 5cfffdd1b2c6bd7cef8c07226b09da8c92d519a7No fix listed
75da24b3b0fb950648d00e7454dae0bb7da64c30 through 5cfffdd1b2c6bd7cef8c07226b09da8c92d519a7No fix listed
Also listed as affected (12)
  • 2.3.0
  • 2.2.7
  • 2.1.16
  • 2.3.4
  • 2.3.3-p1
  • 2.2.11
  • 2.3.2
  • 2.2.9
  • 2.1.18
  • 2.3.1
  • 2.2.8
  • 2.1.17
GIT github.com/magento/magento2 ↗
07465f8ce879ff0bd0ba72a662c9e2473e49afe4 through 59113891b12412626f5b50d1032f6db5a089b8d4No fix listed
f4c1d7526f05bdfb1327b0701cc345f94aadcaed through 5f3b86ab4bd3e3b94e65429fed33f748d29c1bbeNo fix listed
Also listed as affected (5)
  • 2.3.4
  • 2.3.3
  • 2.3.2
  • 2.3.1
  • 2.3.0

Description

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.