CVE-2020-3715

Vulnerability

Overview

CVE-2020-3715 is a stored cross-site scripting (XSS) vulnerability affecting Magento Commerce (Adobe Commerce) and Magento Open Source versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier [1]. The underlying issue allows an attacker to inject malicious scripts that are persistently stored on the server, without requiring authentication or user interaction during the initial injection.

Attack

Vector and Exploitation

An attacker can exploit this stored XSS by submitting crafted input (e.g., via a product review, customer account field, or other user-controllable data) that is not properly sanitized or encoded by the application. Because the script is stored, any user—including administrators—who views the affected page will have the malicious script executed in their browser. The attack requires no special privileges to inject the payload, as it can be delivered through publicly accessible forms or fields. Once the malicious script is stored, it will execute every time the vulnerable page is rendered, affecting all subsequent visitors [1].

Impact

Successful exploitation could lead to disclosure of sensitive information, such as session tokens, cookies, or other data accessible within the user's browser context. In the case of an administrator, the attacker might leverage the XSS to perform privileged actions or exfiltrate administrative credentials. The severity of this vulnerability is rated with a CVSS base score of 6.1 (Medium), indicating a moderate risk to confidentiality and integrity if exploited against authenticated users [1].

Mitigation

Adobe has addressed this vulnerability in security updates for Magento. Merchants should upgrade to Magento 2.3.4 or later, 2.2.11 or later, or for the 1.x branch, apply the latest patches available through the Magento Security Center. No workaround exists beyond upgrading to a fixed version. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest update, but prompt patching is recommended due to the low complexity of exploitation [1].