CVE-2020-15244
RCE in Magento
CVE-2020-15244 is a high vulnerability (CVSS 8.0) in Openmage Magento, published October 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in openmage/magento-lts 19.4.8.
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
RCE in Magento
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
- Record
CVE-2020-15244- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-502, CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2020-1431
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
- Record
EUVD-2020-1431- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jrgf-vfw2-hj26
RCE via PHP Object injection via SOAP Requests
Impact
This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.
Patches
The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved
Credits
Credit to Luke Rodgers for reporting
- Record
GHSA-jrgf-vfw2-hj26- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-74, CWE-502
- Updated
- 2026-11-02
NVD
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
- Record
CVE-2020-15244- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-74, CWE-502
- Updated
- 2026-11-02
OSV
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
- Record
CVE-2020-15244- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-jrgf-vfw2-hj26
RCE via PHP Object injection via SOAP Requests
Impact
This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.
Patches
The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved
Credits
Credit to Luke Rodgers for reporting
- Record
GHSA-jrgf-vfw2-hj26- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-502, CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openmage/magento-ltsPackagist |
before 19.4.8 | 19.4.8 |
openmage/magento-ltsPackagist |
20.0.0 up to 20.0.4 | 20.0.4 |
openmage/magento-ltsPackagist |
before 19.4.8, plus listed versions 1.9.1.11.9.2.01.9.2.11.9.2.21.9.2.3 Show 11 moreShow less1.9.2.41.9.3.01.9.3.1v19.4.0v19.4.1v19.4.2v19.4.3v19.4.4v19.4.5v19.4.6v19.4.7 |
19.4.8 |
openmage/magento-ltsPackagist |
20.0.0 up to 20.0.4, plus listed versions v20.0.0v20.0.1v20.0.2v20.0.3 |
20.0.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |