CVE-2020-15244

HIGH8.0EPSS 0.87%

RCE via PHP Object injection via SOAP Requests

Published: 10/30/2020Modified: 3/13/2026
Also known as:GHSA-jrgf-vfw2-hj26

Description

### Impact This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. ### Patches The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved ### Credits Credit to Luke Rodgers for reporting

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH8.0CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References (4)