CVE-2020-26252
In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.06% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22, CWE-434
- Affected
- openmage/openmage
- Source
- security-advisories@github.com
References
- https://github.com/OpenMage/magento-lts/commit/0786aa48bc7b618cfe37b59f45e1da3714c533c3Patch, Third Party Advisory
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-99m6-r53j-4hh2Third Party Advisory
- https://github.com/OpenMage/magento-lts/commit/0786aa48bc7b618cfe37b59f45e1da3714c533c3Patch, Third Party Advisory
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-99m6-r53j-4hh2Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.