HIGH8.0

GHSA-jrgf-vfw2-hj26

RCE via PHP Object injection via SOAP Requests

Quick fix

GHSA-jrgf-vfw2-hj26 — openmage/magento-lts: upgrade to the fixed version with the command below.

composer require openmage/magento-lts:^19.4.8

Details

### Impact This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

### Patches The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved

### Credits Credit to Luke Rodgers for reporting

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/openmage/magento-lts

Introduced in: 0Fixed in: 19.4.8

Fixcomposer require openmage/magento-lts:^19.4.8

Packagist/openmage/magento-lts

Introduced in: 20.0.0Fixed in: 20.0.4

Fixcomposer require openmage/magento-lts:^20.0.4

References

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2020-15244[ADVISORY]
https://github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b[WEB]
https://github.com/OpenMage/magento-lts[PACKAGE]