GitHub Advisoryadvisory · Packagist

GHSA-jrgf-vfw2-hj26 RCE via PHP Object injection via SOAP Requests

HIGH Published 2020-10-30 Modified 2021-11-19 Official page ↗
Aliases
CVE-2020-15244
Ecosystem
Packagist
Packages
openmage/magento-lts
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-502, CWE-74
Reviewed
2020-10-30

Affected packages

• Packagist openmage/magento-lts: < 19.4.8 → fixed in 19.4.8 • Packagist openmage/magento-lts: >= 20.0.0, < 20.0.4 → fixed in 20.0.4

Description

Impact This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. Patches The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved Credits Credit to Luke Rodgers for reporting

Related

Alias · CVE (1)

  • CVE-2020-15244 In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can… vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References