CVE-2020-26295
In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.78% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22, CWE-434
- Affected
- openmage/openmage
- Source
- security-advisories@github.com
References
- https://github.com/OpenMage/magento-lts/commit/9cf8c0aa1d1306051a18ace08d40279dadc1fb35Patch, Third Party Advisory
- https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10Third Party Advisory
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-52c6-6v3v-f3fgThird Party Advisory
- https://github.com/OpenMage/magento-lts/commit/9cf8c0aa1d1306051a18ace08d40279dadc1fb35Patch, Third Party Advisory
- https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10Third Party Advisory
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-52c6-6v3v-f3fgThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.