CVE-2020-9588: 
PHP vulnerability analysis and mitigation

Magento versions 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier were affected by an observable timing discrepancy vulnerability identified as CVE-2020-9588. The vulnerability was discovered and assigned on March 2, 2020, and was publicly disclosed in June 2020. This security flaw could potentially lead to signature verification bypass in affected Magento installations (CVE Details, NVD).

The vulnerability is classified as an Observable Timing Discrepancy (CWE-203) issue. According to the National Vulnerability Database, it received a CVSS v3.1 base score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and a CVSS v2.0 base score of 6.5 (Medium) with the vector string (AV:N/AC:L/Au:S/C:P/I:P/A:P) (NVD).

Successful exploitation of this vulnerability could lead to signature verification bypass, potentially compromising the security of affected Magento installations. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the system (SecurityWeek).

The vulnerability requires network access and high privileges for exploitation, but has low attack complexity as indicated by the CVSS vector string. No user interaction is required for exploitation (NVD).

Adobe released patches to address this vulnerability in Magento Commerce and Magento Open Source versions 2.3.4-p2 and 2.3.5-p1, Magento Enterprise Edition 1.14.4.5, and Magento Community Edition 1.9.4.5 (SecurityWeek).