RCE via PHP Object injection via SOAP Requests

높음 7.2CVE-2020-15244 · GHSA-jrgf-vfw2-hj26 · Published 21/10/2020 · updated 17/06/2026

요약

CVE-2020-15244은(는) openmage/magento-lts, magento (openmage)에 영향을 주는 높음 (CVSS 7.2) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.3%, 전체 취약점의 69.7%보다 높음.
조치: 20.0.4, 19.4.8 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
openmage/magento-lts Packagist	`≥ 20.0.0, < 20.0.4< 19.4.8`	`20.0.419.4.8`
magento openmage	`≥ 20.0.0, < 20.0.4≤ 19.4.8`	`20.0.4`

Description

Impact

This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

Patches

The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved

Credits

Credit to Luke Rodgers for reporting

NVD description

In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.

References

OpenMage/magento-lts security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-15244 · ADVISORY
OpenMage/magento-lts commit 26433d1 · WEB
OpenMage/magento-lts · PACKAGE

openmage/magento-lts의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openmage/magento-lts

Packagist

≥ 20.0.0, < 20.0.4< 19.4.8

20.0.419.4.8

magento

openmage

≥ 20.0.0, < 20.0.4≤ 19.4.8

20.0.4

Description

Impact

This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

Patches

The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved

Credits

Credit to Luke Rodgers for reporting

NVD description

openmage/magento-lts의 다른 취약점

모두 보기 →