CVE-2020-9584

Magento versions 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier contain a stored cross-site scripting (XSS) vulnerability [1]. This type of vulnerability occurs when user-supplied input is not properly sanitized before being stored and later served to other users, allowing an attacker to inject malicious scripts into the application [1].

To exploit this, an attacker would typically need to have access to the Magento admin panel or a privileged user role that can create or edit content (such as product descriptions, blocks, or pages) where the stored input is rendered [1]. The attack does not require authentication from the victim, as the malicious script executes when any user views the compromised page [1].

The impact of successful exploitation is sensitive information disclosure, which could include session tokens, admin credentials, or other confidential data accessible in the victim's browser context [1]. This can lead to further compromise of the Magento instance and associated customer data.

Adobe has released security patches to address this vulnerability in later versions of Magento [2]. Users on affected versions should upgrade to Magento 2.3.5 or later, 2.2.12 or later, or the latest versions of Magento 1 (though Magento 1 reached end-of-life) to eliminate the risk [1].