CVE-2020-9587

Vulnerability

Overview CVE-2020-9587 is an authorization bypass vulnerability in Adobe Magento (formerly Magento Commerce and Magento Open Source) affecting versions 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier [1]. The root cause is a flaw in the authorization logic that fails to properly enforce access controls, allowing an attacker to perform actions that should require higher privileges.

Exploitation

Scenario Exploitation does not require authentication? The official description does not specify the access level needed, but an attacker could potentially be an unauthenticated user or a low-privileged authenticated user who can bypass normal authorization checks. The attack surface is likely a web request that modifies product pricing or discount rules [1]. No network position or complex prerequisites are detailed in the sources.

Impact

Successful exploitation could lead to unauthorized product discounts, meaning an attacker could alter the final price of items at checkout, resulting in financial loss for the merchant [1]. No evidence of remote code execution or data breach is provided in the available references; the impact is confined to e-commerce transaction manipulation.

Mitigation

Status No patches are explicitly referenced in the provided sources. However, Magento typically issues security updates; users should check Adobe's security advisories for the latest fixes. As of publication (June 2020), affected versions remain vulnerable unless updated [1].