Description

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

Remediation

References

CVE-2020-9588

Related Vulnerabilities

WordPress Plugin WP Business Intelligence Lite Arbitrary File Upload (1.0.6)

Oracle HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-5000)

MySQL CVE-2017-10296 Vulnerability (CVE-2017-10296)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-5547)

WordPress Plugin RAYS Grid Cross-Site Request Forgery (1.2.2)

Severity

High

Classification

CVE-2020-9588 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities