CVE-2020-9582: 
PHP vulnerability analysis and mitigation

Magento versions 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier were affected by a command injection vulnerability discovered in early 2020. The vulnerability, tracked as CVE-2020-9582, was assigned a critical severity rating with a CVSS base score of 9.8, indicating its serious nature. When successfully exploited, this vulnerability could lead to arbitrary code execution on affected systems (NVD, CVE).

The vulnerability is classified as an Improper Neutralization of Special Elements used in a Command (Command Injection) vulnerability, identified as CWE-77. It received a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that it can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD).

Successful exploitation of this vulnerability could lead to arbitrary code execution on affected systems, potentially allowing attackers to take complete control of the targeted Magento installation. The critical severity rating and high CVSS score indicate that this vulnerability poses a significant risk to affected systems (SecurityWeek).

The vulnerability does not require authentication for successful exploitation, making it particularly dangerous. It was one of six critical vulnerabilities patched in Magento during the same security update, all of which could be exploited to execute code on vulnerable systems (SecurityWeek, Threatpost).

Adobe released patches to address this vulnerability in Magento Commerce and Open Source 2.3.4-p2 and 2.3.5-p1, Magento Enterprise Edition 1.14.4.5, and Magento Community Edition 1.9.4.5. Users are strongly advised to update to these patched versions to protect against potential exploitation (SecurityWeek).