Magento observable timing discrepancy vulnerability

MOYENNE 4.2CVE-2020-9690 · BIT-magento-2020-9690 · GHSA-xgp9-j48h-jjf9 · Published 29/07/2020 · updated 17/06/2026

En bref

CVE-2020-9690 est une vulnérabilité MOYENNE (CVSS 4.2) touchant magento/community-edition, magento (magento).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.8%, plus élevée que 79.1% des vulnérabilités.
Correctif : mettre à jour vers 2.3.5-p2, 2.3.5 ou plus récent.

Package	Affected versions	Patched versions
magento/community-edition Packagist	`< 2.3.5-p2`	`2.3.5-p2`
magento magento	`= 2.3.5< 2.3.5`	`2.3.5`

Description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

NVD description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

References

nvd.nist.gov/vuln/detail/CVE-2020-9690 · ADVISORY
magento/magento2 commit 9436781 · WEB
magento/magento2 · PACKAGE
helpx.adobe.com/security/products/magento/apsb20-47.html · WEB

Autres vulnérabilités de magento/community-edition

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

magento/community-edition

Packagist

< 2.3.5-p2

2.3.5-p2

magento

= 2.3.5< 2.3.5

2.3.5

Description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

NVD description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

Autres vulnérabilités de magento/community-edition

Tout voir →