Description

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Remediation

References

CVE-2020-9664

Related Vulnerabilities

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-9861)

WordPress 3.8.x Multiple Vulnerabilities (3.8 - 3.8.21)

Oracle JRE CVE-2012-0507 Vulnerability (CVE-2012-0507)

WordPress Plugin WooCommerce HTML Injection (6.5.1)

WordPress Plugin Contact Form, Drag and Drop Form Builder for WordPress-Everest Forms SQL Injection (1.4.9)

Severity

Critical

Classification

CVE-2020-9664 CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities