CVE-2020-9665: Magento Stored Cross-Site Scripting Vulnerability
Summary
CVE-2020-9665: Magento stored cross-site scripting vulnerability. Affects magento/core versions < 1.9.4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that provides merchants with a flexible shopping cart system and control over the look, content, and functionality of their online store. It is widely used for building and managing online stores. The vulnerability affects Magento versions 1.14.4.5 and earlier, as well as 1.9.4.5 and earlier. These versions are susceptible to a stored cross-site scripting vulnerability, which can lead to the disclosure of sensitive information.
Vulnerability Detail
The stored cross-site scripting vulnerability in Magento allows an attacker to inject malicious code into the application, which is then stored and executed when accessed by other users. This can result in the disclosure of sensitive information, such as user credentials or payment details. The vulnerability originates from improper input validation and sanitization, allowing the attacker to bypass security measures and inject malicious code. Successful exploitation of this vulnerability can have severe consequences for both the affected users and the reputation of the affected online store.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Applying the patch SUPEE-11346 is the recommended solution to fix the issue.
Conclusion
The stored cross-site scripting vulnerability in Magento can have serious consequences for affected users and online stores. It is crucial to apply the patch SUPEE-11346 to mitigate the risk of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/core →
FAQ
Magento versions 1.14.4.5 and earlier, as well as 1.9.4.5 and earlier, are affected by this stored cross-site scripting vulnerability.
Successful exploitation of this vulnerability can lead to the disclosure of sensitive information, such as user credentials and payment details.
Yes, a patch named SUPEE-11346 is available for download from the Magento Open Source Download Page.
No specific workarounds are provided for this vulnerability. Applying the patch is the recommended solution.
To keep your Magento installation secure, it is important to regularly update it with the latest security patches and follow best practices for secure coding and configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/core.
