Magento Magento 2.3.5 Patch 1 Open Source Edition

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:magento:magento:2.3.5:p1:*:*:open_source:*:*:*

part: a version: 2.3.5 update: p1

VendorMagento (aa019b60-1c50-5218-ad20-1f4a9a786d94)
ProductMagento (6f0f93c5-be7a-5b05-986f-1521453ea442)
Edition*
Language*
Software editionopen_source
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/firegento/magento purl2cpe 2026-06-01 10:18:21.416358
pkg:magento/project-community-edition purl2cpe 2026-06-01 10:18:21.416360

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-9692 vulnerable 2026-06-08 05:28:02.609844 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:48.000Z
Updated: 2024-08-04T10:34:39.935Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-9691 vulnerable 2026-06-08 05:28:02.608871 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:52.000Z
Updated: 2024-08-04T10:34:39.934Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-9690 vulnerable 2026-06-08 05:28:02.604173 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.
Published: 2020-07-29T12:20:42.000Z
Updated: 2024-08-04T10:34:39.927Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-9689 vulnerable 2026-06-08 05:28:02.603163 Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:36.000Z
Updated: 2024-08-04T10:34:39.993Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24408 vulnerable 2026-06-08 05:22:33.019273 Stored XSS in customer address upload feature
MEDIUM (6.1)
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.
Published: 2020-10-16T14:03:11.096Z
Updated: 2024-09-17T03:02:26.471Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24407 vulnerable 2026-06-08 05:22:33.018275 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24405 vulnerable 2026-06-08 05:22:33.016443 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24404 vulnerable 2026-06-08 05:22:33.015466 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24403 vulnerable 2026-06-08 05:22:33.014704 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24402 vulnerable 2026-06-08 05:22:33.013923 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24401 vulnerable 2026-06-08 05:22:33.012698 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.