CVE-2020-9630 Magento business logic error vulnerability
Attackers can exploit a business logic error in Magento to escalate privileges, requiring administrators to upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9630?
CVE-2020-9630 is a critical vulnerability in Magento Magento, published on 26 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation could lead to privilege escalation.
Which versions are affected by CVE-2020-9630?
9 open source packages ship an affected version, including magento/community-edition, magento and magento/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
magento/community-edition Packagist | All versions to 2.2.11 | None |
magento/community-edition Packagist | All versions to 2.2.11 | None |
magento/community-edition Packagist | From 2.3.0 | 2.3.4-p2 |
magento/community-edition Packagist | From 2.3.0 | 2.3.4-p2 |
magento Bitnami | From 2.2.0 | 2.2.12, 2.3.5 |
magento/core Packagist | All versions | 1.9.4.5 |
3 more packages
magento/core Packagist | All versions | 1.9.4.5 |
magento/project-community-edition Packagist | All versions to 2.0.2 | None |
magento/project-community-edition Packagist | All versions to 2.0.2 | None |
Products include Magento Magento.
How do I fix CVE-2020-9630?
Upgrade magento/community-edition to 2.3.4-p2 or later.
Is CVE-2020-9630 being exploited?
There is no known exploitation of CVE-2020-9630 in the wild and no public exploit code.
Other vulnerabilities in Magento Magento
Sources
Also known as BIT-magento-2020-9630, GHSA-5j4w-v87m-8r65.