Magento Magento 2.3.5 Patch 1 Commerce Edition

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:magento:magento:2.3.5:p1:*:*:commerce:*:*:*

part: a version: 2.3.5 update: p1

VendorMagento (aa019b60-1c50-5218-ad20-1f4a9a786d94)
ProductMagento (6f0f93c5-be7a-5b05-986f-1521453ea442)
Edition*
Language*
Software editioncommerce
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/firegento/magento purl2cpe 2026-06-01 10:18:21.416355
pkg:magento/project-community-edition purl2cpe 2026-06-01 10:18:21.416356

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-9692 vulnerable 2026-06-08 05:28:02.609824 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:48.000Z
Updated: 2024-08-04T10:34:39.935Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-9691 vulnerable 2026-06-08 05:28:02.608851 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:52.000Z
Updated: 2024-08-04T10:34:39.934Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-9690 vulnerable 2026-06-08 05:28:02.604061 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.
Published: 2020-07-29T12:20:42.000Z
Updated: 2024-08-04T10:34:39.927Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-9689 vulnerable 2026-06-08 05:28:02.602384 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:36.000Z
Updated: 2024-08-04T10:34:39.993Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24408 vulnerable 2026-06-08 05:22:33.019143 Stored XSS in customer address upload feature
MEDIUM (6.1)
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.
Published: 2020-10-16T14:03:11.096Z
Updated: 2024-09-17T03:02:26.471Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24407 vulnerable 2026-06-08 05:22:33.018010 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24405 vulnerable 2026-06-08 05:22:33.016320 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24404 vulnerable 2026-06-08 05:22:33.015450 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24403 vulnerable 2026-06-08 05:22:33.014566 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24402 vulnerable 2026-06-08 05:22:33.013904 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24401 vulnerable 2026-06-08 05:22:33.011918 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.