CVE-2020-9632 Magento security mitigation bypass vulnerability
Attackers can bypass security mitigations in Magento to achieve arbitrary code execution, requiring immediate upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9632?
CVE-2020-9632 is a critical vulnerability in Magento Magento, published on 26 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
Which versions are affected by CVE-2020-9632?
9 open source packages ship an affected version, including magento/community-edition, magento and magento/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
magento/community-edition Packagist | All versions to 2.2.11 | None |
magento/community-edition Packagist | All versions to 2.2.11 | None |
magento/community-edition Packagist | From 2.3.0 | 2.3.4-p2 |
magento/community-edition Packagist | From 2.3.0 | 2.3.4-p2 |
magento Bitnami | From 2.2.0 | 2.2.12, 2.3.5 |
magento/core Packagist | All versions | 1.9.4.5 |
3 more packages
magento/core Packagist | All versions | 1.9.4.5 |
magento/project-community-edition Packagist | All versions to 2.0.2 | None |
magento/project-community-edition Packagist | All versions to 2.0.2 | None |
Products include Magento Magento.
How do I fix CVE-2020-9632?
Upgrade magento/community-edition to 2.3.4-p2 or later.
Is CVE-2020-9632 being exploited?
There is no known exploitation of CVE-2020-9632 in the wild and no public exploit code.
Other vulnerabilities in Magento Magento
Sources
Also known as BIT-magento-2020-9632, GHSA-6w29-x5j4-qhrw.