CVE-2020-9591: Magento defense-in-depth security mitigation vulnerability
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.79095%
CWE
Published
5/24/2022
Updated
1/11/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.3.0, < 2.3.4-p2 | 2.3.4-p2 |
| magento/community-edition | composer | <= 2.2.11 | |
| magento/core | composer | < 1.9.4.5 | 1.9.4.5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability relates to defense-in-depth failures in admin panel access control. CWE-200 (sensitive information exposure) suggests authentication/authorization bypass vectors.
- _processUrlKeys is critical for validating secret keys in admin URLs. A flawed implementation could allow attackers to bypass the secret key requirement (a defense-in-depth layer).
- The authentication plugin's aroundDispatch method is central to admin session validation. While the high-confidence entry focuses on the URL key validation (directly tied to the 'defense-in-depth' description), the session validation mechanism is a secondary candidate given the unauthorized access impact.
These conclusions align with Magento's security architecture and the vulnerability's nature, though exact patch details are unavailable for full confirmation.