CVE-2020-3716
CVE-2020-3716
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS 9.8 · Critical · EPSS 14.0% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
magento
- Versions
- 2.3.3 and earlier: Affected
- 2.2.10 and earlier: Affected
- 1.14.4.3 and earlier: Affected
- 1.9.4.3 and earlier versions: Affected
No fix published
magento/community-edition Packagist
- Versions
- 2.2.0
- 2.2.1
- 2.2.10
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.2.6
- 2.2.7
- 2.2.8
- 2.2.9
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.11
Update to 2.2.11
magento/community-edition Packagist
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- 2.3.2-p2
- 2.3.3
- 2.3.3-p1
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.4
Update to 2.3.4