CRITICAL9.8

GHSA-x9p7-vgp2-9pq2

Magento security bypass vulnerability

Quick fix

GHSA-x9p7-vgp2-9pq2 — magento/community-edition: upgrade to the fixed version with the command below.

composer require magento/community-edition:^2.3.4

Details

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/magento/community-edition

Introduced in: 2.3.0Fixed in: 2.3.4

Fixcomposer require magento/community-edition:^2.3.4

Packagist/magento/community-edition

Introduced in: 0Fixed in: 2.2.11

Fixcomposer require magento/community-edition:^2.2.11

Packagist/magneto/core

Introduced in: 0Fixed in: 1.9.4.4

Fixcomposer require magneto/core:^1.9.4.4

References

https://nvd.nist.gov/vuln/detail/CVE-2020-3718[ADVISORY]
https://github.com/magento/magento2[PACKAGE]
https://helpx.adobe.com/security/products/magento/apsb20-02.html[WEB]