CVE-2020-9691

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.

Recent assessments:

ericalexanderorg at August 03, 2020 6:46pm UTC reported:

Not enough data ATM to accurately talk risk, but there’s some concerning factors. Taking an educated guess an value & exploitability.

> dom-based cross-site scripting
>
> CVSS PR:N – No authentication required
>
> Magento v1 just hit EOL and this patch is only v2. It’s not going to be a simple patch operation for many as they navigate dependencies from the v1 to v2 jump.
>
> Magento put the mage in magecart – it’s a popular target

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 2