CVE-2020-15244: Deserialization of Untrusted Data

October 30, 2020 (updated November 19, 2021)

In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.

References

github.com/OpenMage/magento-lts
github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b
github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26
github.com/advisories/GHSA-jrgf-vfw2-hj26
nvd.nist.gov/vuln/detail/CVE-2020-15244

Code Behaviors & Features

Detect and mitigate CVE-2020-15244 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →