Vulnerability advisory

GHSA-874g-pxqp-frqp

Magento Path Traversal

Published May 24, 2022Updated Mar 6, 2024OSV record ↗

Also known as BIT-magento-2020-3717CVE-2020-3717

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.2.0` to before 2.2.11	`2.2.11`Advisories →
Also listed as affected (11) `2.2.0` `2.2.1` `2.2.10` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9`
`2.3.0` to before 2.3.4	`2.3.4`Advisories →
Also listed as affected (6) `2.3.0` `2.3.1` `2.3.2` `2.3.2-p2` `2.3.3` `2.3.3-p1`

Description

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2020-3717 ↗
Packagegithub.com/magento/magento2 ↗
Webhelpx.adobe.com/security/products/magento/apsb20-02.html ↗