CVE-2020-3716
published 2020-01-29CVE-2020-3716: Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
13.96%
96.1th percentile
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | magento | — | — |
| adobe | magento | — | — |
| adobe | magento | — | — |
| adobe | magento | — | — |
| magento | community-edition | >= 2.2.0 < 2.2.11 | 2.2.11 |
| magento | community-edition | >= 2.3.0 < 2.3.4 | 2.3.4 |
| magento | magento | <= 1.9.4.3 | — |
| magento | magento | <= 1.14.4.3 | — |
| magento | magento | 2.2.0 – 2.2.10 | — |
| magento | magento | 2.3.0 – 2.3.3 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Magento deserialization vulnerability
ghsa·2022-05-24
CVE-2020-3716 [CRITICAL] CWE-502 Magento deserialization vulnerability
Magento deserialization vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
OSV
Magento deserialization vulnerability
osv·2022-05-24
CVE-2020-3716 [CRITICAL] Magento deserialization vulnerability
Magento deserialization vulnerability
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Suricata
ET WEB_SERVER ImageMagick CVE-2016-3716 Move File Inbound (msl: + mvg)
suricata·2016-05-04·CVSS 3.3
CVE-2016-3716 [LOW] ET WEB_SERVER ImageMagick CVE-2016-3716 Move File Inbound (msl: + mvg)
ET WEB_SERVER ImageMagick CVE-2016-3716 Move File Inbound (msl: + mvg)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3716 Move File Inbound (msl: + mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"msl"; nocase; pcre:"/^\s*\x3a\s*[./]/Ri"; classtype:web-application-attack; sid:2022793; rev:5; metadata:created_at 2016_05_04, cve CVE_2016_3716, signature_severity Major, updated_at 2020_10_06;)
No public exploits indexed.
No writeups or analysis indexed.
2020-01-29
Published