GitHub Advisoryadvisory · Packagist

GHSA-crf2-xm6x-46p6 Observable Timing Discrepancy in OpenMage LTS

HIGH Published 2020-08-19 Modified 2021-11-19 Official page ↗
Aliases
CVE-2020-15151
Ecosystem
Packagist
Packages
openmage/magento-lts
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-203, CWE-352
Reviewed
2020-08-19

Affected packages

• Packagist openmage/magento-lts: < 19.4.6 → fixed in 19.4.6 • Packagist openmage/magento-lts: >= 20.0.0, < 20.0.2 → fixed in 20.0.2

Description

Impact This vulnerability allows to circumvent the formkey protection in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks Patches The latest OpenMage Versions up from 19.4.6 and 20.0.2 have this Issue solved References Related to Adobes CVE-2020-9690 ( https://helpx.adobe.com/security/products/magento/apsb20-47.html ) fixed in Magento2 https://github.com/magento/magento2/commit/52d72b8010c9cecb5b8e3d98ec5edc1ddcc65fb4 as part of 2.4.0/2.3.5-p2

Related

Alias · CVE (1)

  • CVE-2020-15151 OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases… vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-352 Cross-Site Request Forgery weakness

References