PT-2020-14229 · Openmage · Openmage

Flyingmana + 1 · Published 2020-08-19 · Updated 2024-03-06 · CVE-2020-15151

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenMage versions prior to 19.4.6 OpenMage versions prior to 20.0.2

Description This issue allows attackers to circumvent the fromkey protection in the Admin Interface, increasing the attack surface for Cross Site Request Forgery attacks.

Recommendations For versions prior to 19.4.6, update to version 19.4.6 or later. For versions prior to 20.0.2, update to version 20.0.2 or later. As a temporary workaround, consider restricting access to the Admin Interface to minimize the risk of exploitation.

Fix

CSRF

Side Channel Attack

Weakness Enumeration

CWE-352

CWE-203

Related Identifiers

BIT-MAGENTO-2020-15151

CVE-2020-15151

GHSA-CRF2-XM6X-46P6

Affected Products

Openmage

References · 8

• https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347a · Patch
• https://osv.dev/vulnerability/GHSA-crf2-xm6x-46p6 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-47.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-15151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15151 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15151 · Vendor Advisory
• https://github.com/OpenMage/magento-lts · Note
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6 · Note