CVE-2020-9664: Magento php object injection vulnerability
Magento php object injection vulnerability
Other sources
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Magento Open Source 1.xto a version that resolves this vulnerability.Patch SUPEE-11346
Event History
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2020-9664.
Which versions of Magento are affected by this vulnerability?
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier are affected by this vulnerability.
What is the severity of CVE-2020-9664?
The severity of CVE-2020-9664 is critical with a severity value of 9.8.
What is the potential impact of this vulnerability?
Successful exploitation of this vulnerability could lead to arbitrary code execution.
How can I fix CVE-2020-9664?
To fix CVE-2020-9664, you should update to a version of Magento that is not affected by this vulnerability.