Adobe Security Bulletin

Adobe Security Bulletin

Search
User Guide

On this page

Applies to: Digital Editions

某些 Creative Cloud 应用程序、服务和功能在中国不可用。

Security Updates Available for Magento | APSB20-59
Bulletin ID Date Published Priority
ASPB20-59 October 15th, 2020       2

Summary

Magento has released updates for Magento Commerce and Magento Open Source. These updates resolve vulnerabilities  rated important and critical. Successful exploitation could lead to arbitrary code execution.    

Affected Versions

Product Version Platform
Magento Commerce 
 2.3.5-p1 and earlier versions  
 All
Magento Commerce 
 2.3.5-p2 and earlier versions  
 All
Magento Commerce 
 2.4.0 and earlier versions 
 All
Magento Open Source 
 2.3.5-p1 and earlier versions
 All
Magento Open Source 
 2.3.5-p2 and earlier versions
 All
Magento Open Source 
 2.4.0 and earlier versions 
 All

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version.

Product Updated Version Platform Priority Rating Release Notes
Magento Commerce 
 2.4.1
 All
 2
 2.4.1 Commerce
Magento Open Source 
 2.4.1
 All
 2
 2.4.1 Open Source 
         
Magento Commerce 
 2.3.6
 All 2 2.3.6 Commerce
Magento Open Source 
 2.3.6
 All 2 2.3.6 Open Source

Vulnerability details

Vulnerability Category Vulnerability Impact Severity Pre-authentication? Admin privileges required?

 Magento Bug ID CVE numbers
File Upload Allow List Bypass
 Arbitrary code execution 
 Critical 
 No
 Yes
 PRODSECBUG-2799
 CVE-2020-24407
SQL Injection
 Arbitrary read or write access to database Critical 
 No
 Yes
 PRODSECBUG-2779
 CVE-2020-24400
Improper Authorization
 Unauthorized modification of customer list Important
 No
 Yes
 PRODSECBUG-2789
 CVE-2020-24402
Insufficient Invalidation of User Session
 Unauthorized access to restricted resources Important
 No
 Yes
 PRODSECBUG-2785
 CVE-2020-24401
Improper Authorization
 Unauthorized modification of Magento CMS pages
 Important
 No
 Yes
 PRODSECBUG-2796
 CVE-2020-24404
Sensitive Information Disclosure
 Disclosure of document root path Moderate
 No
 Yes
 PRODSECBUG-2798
 CVE-2020-24406
Cross-site Scripting (Stored XSS)
 Arbitrary JavaScript execution in the browser Important
 Yes
 No
 PRODSECBUG-2804
 CVE-2020-24408
Improper Authorization
 Unauthorized access to restricted resources Important
 No
 Yes
 PRODSECBUG-2797
 CVE-2020-24405
Improper Authorization
 Unauthorized access to restricted resources Important
 No
 Yes
 PRODSECBUG-2791
 CVE-2020-24403

Note

Pre-authentication:  The vulnerability is exploitable without credentials.   

Admin privileges required:  The vulnerability is only exploitable by an attacker with administrative privileges.  

Additional technical descriptions of the CVEs referenced in this document will be made available on MITRE and NVD sites.

Updates to dependencies

Dependency Vulnerability Impact Affected Versions
jQuery File Upload Arbitrary code execution 
 2.4.0 and earlier versions 
TinyMCE Arbitrary JavaScript execution 2.4.0 and earlier versions 

Acknowledgments

Adobe would like to thank the following individuals for reporting the relevant issues and for working with Adobe to help protect our customers:   

  • Edgar Boda-Majer of Bugscale (CVE-2020-24408) 
  • Kien Hoang (CVE-2020-24402, CVE-2020-24401, CVE-2020-24404, CVE-2020-24405)
  • Ihorsv (CVE-2020-24406) 
  • Malerisch (CVE-2020-24407)
  • Dang Toan (CVE-2020-24403)
  • Yonatan Offek (CVE-2020-24400)