{"api_version":"1","generated_at":"2026-07-24T22:55:22+00:00","cve":"CVE-2020-9587","urls":{"html":"https://cve.report/CVE-2020-9587","api":"https://cve.report/api/cve/CVE-2020-9587.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-9587","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-9587"},"summary":{"title":"CVE-2020-9587","description":"Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.","state":"PUBLIC","assigner":"psirt@adobe.com","published_at":"2020-06-26 21:15:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb20-22.html","name":"https://helpx.adobe.com/security/products/magento/apsb20-22.html","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Adobe Security Bulletin","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9587","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9587","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"9587","vulnerable":"1","versionEndIncluding":"1.14.4.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"magento","cpe5":"magento","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"9587","vulnerable":"1","versionEndIncluding":"1.9.4.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"magento","cpe5":"magento","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"9587","vulnerable":"1","versionEndIncluding":"2.2.11","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"magento","cpe5":"magento","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"commerce","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"9587","vulnerable":"1","versionEndIncluding":"2.2.11","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"magento","cpe5":"magento","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"open_source","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"9587","vulnerable":"1","versionEndIncluding":"2.3.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"magento","cpe5":"magento","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"commerce","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"9587","vulnerable":"1","versionEndIncluding":"2.3.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"magento","cpe5":"magento","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"open_source","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-9587","qid":"996648","title":"PHP (Composer) Security Update for magento/community-edition (GHSA-8wm7-h2qh-ff4c)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ASSIGNER":"psirt@adobe.com","ID":"CVE-2020-9587","STATE":"PUBLIC"},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Authorization bypass"}]}]},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Magento","version":{"version_data":[{"version_value":"2.3.4 and earlier, 2.2.11 and earlier  (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier versions"}]}}]},"vendor_name":"Adobe"}]}},"references":{"reference_data":[{"name":"https://helpx.adobe.com/security/products/magento/apsb20-22.html","refsource":"CONFIRM","url":"https://helpx.adobe.com/security/products/magento/apsb20-22.html"}]},"description":{"description_data":[{"lang":"eng","value":"Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts."}]}},"nvd":{"publishedDate":"2020-06-26 21:15:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*","versionStartIncluding":"2.2.0","versionEndIncluding":"2.2.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*","versionStartIncluding":"2.3.0","versionEndIncluding":"2.3.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*","versionStartIncluding":"2.3.0","versionEndIncluding":"2.3.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*","versionStartIncluding":"2.2.0","versionEndIncluding":"2.2.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:magento:magento:*:*:*:*:community:*:*:*","versionEndIncluding":"1.9.4.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:magento:magento:*:*:*:*:enterprise:*:*:*","versionEndIncluding":"1.14.4.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"9587","Ordinal":"169979","Title":"CVE-2020-9587","CVE":"CVE-2020-9587","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"9587","Ordinal":"1","NoteData":"Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"9587","Ordinal":"2","NoteData":"2020-06-26","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"9587","Ordinal":"3","NoteData":"2020-06-26","Type":"Other","Title":"Modified"}]}}}