CVE-2020-9584: Magento Stored cross-site scripting
Magento Stored cross-site scripting
Other sources
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/coreto a version that resolves this vulnerability.Fixed in 1.9.4.5 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.12 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.4-p2
Event History
Frequently Asked Questions
What is the vulnerability ID of this Magento vulnerability?
The vulnerability ID of this Magento vulnerability is CVE-2020-9584.
What is the severity level of CVE-2020-9584?
The severity level of CVE-2020-9584 is medium.
What is the affected software version range for CVE-2020-9584?
Magento versions 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier are affected by this vulnerability.
What is the impact of CVE-2020-9584?
Successful exploitation of CVE-2020-9584 could lead to sensitive information disclosure.
Is there a fix available for CVE-2020-9584?
Yes, a fix is available for CVE-2020-9584. Please refer to the official Magento security advisory for more information.