Description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

Remediation

References

CVE-2020-9690

Related Vulnerabilities

Apache HTTP Server Improper Input Validation Vulnerability (CVE-2014-0117)

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-8057)

WordPress Plugin WP User Manager-User Profile Builder & Membership Security Bypass (2.6.2)

WordPress Configuration Vulnerability (CVE-2009-2336)

WordPress Plugin BuddyPress Docs Security Bypass (1.9.2)

Severity

Medium

Classification

CVE-2020-9690 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities