CVE-2020-9630: Critical severity centos libgcc vulnerability
Published Jun 26, 2020
·Updated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation could lead to privilege escalation.
Affected Software
10 affected componentsFixes available
composer/magento/project-community-edition<=2.0.2
composer/magento/core<1.9.4.5
1.9.4.5
composer/magento/community-edition>=2.3.0<2.3.4-p2
2.3.4-p2
composer/magento/community-edition<=2.2.11
Magento Magento<=1.9.4.4
Magento Magento<=1.14.4.4
Magento Magento>=2.2.0<=2.2.11
Magento Magento>=2.2.0<=2.2.11
Magento Magento>=2.3.0<=2.3.4
Magento Magento>=2.3.0<=2.3.4
Event History
Jun 26, 2020
CVE Published
via MITRE·08:20 PM
Data Sourced
via MITRE·08:20 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityAffected Software
May 24, 2022
Advisory Published
via GitHub·05:21 PM
Data Sourced
via GitHub·05:21 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2020-9630?
CVE-2020-9630 is a business logic error vulnerability in Magento versions 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier.
2
What is the severity of CVE-2020-9630?
The severity of CVE-2020-9630 is critical with a CVSS score of 9.8.
3
How does CVE-2020-9630 impact Magento?
Successful exploitation of CVE-2020-9630 could lead to privilege escalation.
4
Which versions of Magento are affected by CVE-2020-9630?
Magento versions 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier are affected by CVE-2020-9630.
5
Is there a fix for CVE-2020-9630?
Yes, upgrading to Magento versions 2.3.5 or 2.2.12 or later will fix CVE-2020-9630.