CVE-2020-3717
published 2020-01-29CVE-2020-3717: Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
3.16%
86.5th percentile
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | magento | — | — |
| adobe | magento | — | — |
| adobe | magento | — | — |
| adobe | magento | — | — |
| magento | community-edition | >= 2.2.0 < 2.2.11 | 2.2.11 |
| magento | community-edition | >= 2.3.0 < 2.3.4 | 2.3.4 |
| magento | magento | <= 1.9.4.3 | — |
| magento | magento | <= 1.14.4.3 | — |
| magento | magento | 2.2.0 – 2.2.10 | — |
| magento | magento | 2.3.0 – 2.3.3 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Magento Path Traversal
osv·2022-05-24
CVE-2020-3717 [MEDIUM] Magento Path Traversal
Magento Path Traversal
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.
GHSA
Magento Path Traversal
ghsa·2022-05-24
CVE-2020-3717 [MEDIUM] CWE-22 Magento Path Traversal
Magento Path Traversal
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.
Suricata
ET WEB_SERVER ImageMagick CVE-2016-3717 Local File Read Inbound (label: + mvg)
suricata·2016-05-04·CVSS 5.5
CVE-2016-3717 [MEDIUM] ET WEB_SERVER ImageMagick CVE-2016-3717 Local File Read Inbound (label: + mvg)
ET WEB_SERVER ImageMagick CVE-2016-3717 Local File Read Inbound (label: + mvg)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3717 Local File Read Inbound (label: + mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"label"; nocase; pcre:"/^\s*\x3a\s*\x40/Ri"; classtype:web-application-attack; sid:2022794; rev:5; metadata:created_at 2016_05_04, cve CVE_2016_3717, signature_severity Major, updated_at 2020_10_06;)
No public exploits indexed.
No writeups or analysis indexed.
2020-01-29
Published