Description

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

Remediation

References

CVE-2020-9588

Related Vulnerabilities

WordPress Plugin 301 Redirects-Easy Redirect Manager Security Bypass (2.40)

MySQL CVE-2019-2495 Vulnerability (CVE-2019-2495)

WordPress Plugin Search Unleashed 'Log' Function HTML Injection (0.2.10)

WordPress Plugin Sharebar Multiple Vulnerabilities (1.2.5)

WordPress Improper Input Validation Vulnerability (CVE-2009-2431)

Severity

High

Classification

CVE-2020-9588 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities