openmage/magento-lts · Security
RCE via PHP Object injection via SOAP Requests
- GHSA ID
- GHSA-jrgf-vfw2-hj26
- CVE ID
- CVE-2020-15244
- Severity
- high
- Published
- Updated
- CVSS
- 8 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 8 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Impact
This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.
Patches
The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved
Credits
Credit to Luke Rodgers for reporting
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-502 · Deserialization of Untrusted Data
References
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2020-15244 ↗
- https://github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b ↗
- https://github.com/OpenMage/magento-lts ↗
- https://github.com/advisories/GHSA-jrgf-vfw2-hj26 ↗