PT-2020-14309

CVE-2020-15244

·

Published

2020-10-21

·

Updated

2021-11-18

Description by

CVSS 3.1
8.0
High
MetricsAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions magento-lts versions prior to 19.4.8 magento-lts versions prior to 20.0.4
Description The issue allows an admin user to generate soap credentials that can be used to trigger remote code execution (RCE) via PHP Object Injection through product attributes and a product.
Recommendations For versions prior to 19.4.8, update to version 19.4.8 or later. For versions prior to 20.0.4, update to version 20.0.4 or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')
CWE-502: Deserialization of Untrusted Data
Related identifiers
CVE-2020-15244
GHSA-JRGF-VFW2-HJ26
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com