Vulnerability advisory

GHSA-9wc9-498w-h8xv

Magento deserialization vulnerability

Published May 24, 2022Updated Mar 6, 2024OSV record ↗

Also known as BIT-magento-2020-3716CVE-2020-3716

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.2.0` to before 2.2.11	`2.2.11`Advisories →
Also listed as affected (11) `2.2.0` `2.2.1` `2.2.10` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9`
`2.3.0` to before 2.3.4	`2.3.4`Advisories →
Also listed as affected (6) `2.3.0` `2.3.1` `2.3.2` `2.3.2-p2` `2.3.3` `2.3.3-p1`

Description

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2020-3716 ↗
Packagegithub.com/magento/magento2 ↗
Webhelpx.adobe.com/security/products/magento/apsb20-02.html ↗