Magento observable timing discrepancy vulnerability

MEDIO 4.2CVE-2020-9690 · BIT-magento-2020-9690 · GHSA-xgp9-j48h-jjf9 · Published 29/07/2020 · updated 17/06/2026

In breve

CVE-2020-9690 è una vulnerabilità MEDIO (CVSS 4.2) che riguarda magento/community-edition, magento (magento).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 79.1% delle vulnerabilità.
Correzione: aggiornare a 2.3.5-p2, 2.3.5 o successiva.

Package	Affected versions	Patched versions
magento/community-edition Packagist	`< 2.3.5-p2`	`2.3.5-p2`
magento magento	`= 2.3.5< 2.3.5`	`2.3.5`

Description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

NVD description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

References

nvd.nist.gov/vuln/detail/CVE-2020-9690 · ADVISORY
magento/magento2 commit 9436781 · WEB
magento/magento2 · PACKAGE
helpx.adobe.com/security/products/magento/apsb20-47.html · WEB

Altre vulnerabilità di magento/community-edition

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

magento/community-edition

Packagist

< 2.3.5-p2

2.3.5-p2

magento

= 2.3.5< 2.3.5

2.3.5

Description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

NVD description

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

Altre vulnerabilità di magento/community-edition

Vedi tutto →