CVE-2020-15244: RCE via PHP Object injection via SOAP Requests
Impact This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.
Patches The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved
Credits Credit to Luke Rodgers for reporting
Other sources
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
— MITRE
RCE via PHP Object injection via SOAP Requests
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.0.4 - Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 19.4.8 - Upgrade
Upgrade
openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 19.4.8 - Upgrade
Upgrade
openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.0.4
Event History
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2020-15244.
What is the severity level of CVE-2020-15244?
The severity level of CVE-2020-15244 is high.
How can an admin user trigger remote code execution (RCE) through product attributes and a product?
An admin user can trigger RCE through product attributes and a product by generating soap credentials that can be used for PHP Object Injection.
Which versions of Magento are affected by CVE-2020-15244?
Versions 19.4.8 and 20.0.4 of Magento are affected by CVE-2020-15244.
Is there a patch available for CVE-2020-15244?
Yes, the issue is patched in versions 19.4.8 and 20.0.4 of Magento.