CVE detail
CVE-2020-3716
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
3 source links · newest first
Adobe-owned Magento has plugged multiple critical vulnerabilities in its eponymous content management system, the most severe of which could be exploited by attackers to achieve arbitrary code execution. About the fixed vulnerabilities According to the newest Magento-themed security bulletin (now published as an Adobe security bulletin), three of the six fixed flaws are critical and three are important. In the “critical” category are a deserialization of untrusted data (CVE-2020-3716) and a security bypass (CVE-2020-3718) that … More →
newswww.helpnetsecurity.comJan 30, 2020, 10:08 AMMagento 2.3.4 was released this week with patches for six vulnerabilities, including three that are considered critical. The first of these severe security issues is related to deserialization of untrusted data. Tracked as CVE-2020-3716, the bug could lead to arbitrary code execution.
newswww.securityweek.comJan 29, 2020, 3:46 PM- Magento 2.3.4 addresses three critical Code execution flawsSecurity Affairs
Magento has released version 2.3.4 to address multiple vulnerabilities, some of them are critical code execution issues. Magento version 2.3.4 has addressed several vulnerabilities in its e-commerce platform, come of them are critical code execution issues. The vulnerabilities affect Magento Commerce (2.3.3/2.2.10 and below), Open Source (2.3.3/2.2.10 and below), Enterprise Edition (1.14.4.3 and earlier), and […]
newssecurityaffairs.comJan 29, 2020, 7:26 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2020-9664CVSS 9.8 · Critical
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.
- CVE-2019-8141CVSS 7.2 · High
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative pri…
- CVE-2026-50517CVSS 9.9 · Critical
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
- CVE-2026-21655CVSS 8.7 · High
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0.
- CVE-2026-65497CVSS 7.2 · High
Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
- CVE-2026-65493CVSS 7.5 · High
Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.