{"id":"CVE-2020-15244","aliases":["EUVD-2020-1431","GHSA-jrgf-vfw2-hj26"],"status":"published","title":"RCE in Magento","description":"In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01264,"percentile":0.70123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502","CWE-74"],"published":"2020-10-21T20:05:20Z","modified":"2026-10-24T10:50:37Z","fixes":[{"ecosystem":"Packagist","package":"openmage/magento-lts","fixed_in":["19.4.8","20.0.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.0.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4.8"}]}],"versions":["1.9.1.1","1.9.2.0","1.9.2.1","1.9.2.2","1.9.2.3","1.9.2.4","1.9.3.0","1.9.3.1","v19.4.0","v19.4.1","v19.4.2","v19.4.3","v19.4.4","v19.4.5","v19.4.6","v19.4.7"]},{"source":"osv","ecosystem":"Packagist","package":"openmage/magento-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.0.4"}]}],"versions":["v20.0.0","v20.0.1","v20.0.2","v20.0.3"]}],"products":[{"vendor":"openmage","product":"magento"},{"vendor":"openmage","product":"magento-lts"}],"references":[{"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15244","tags":["advisory"]},{"url":"https://github.com/OpenMage/magento-lts","tags":["Vendor Advisory","advisory","package"]},{"url":"https://github.com/advisories/GHSA-jrgf-vfw2-hj26"}],"sources":{"cve":[{"id":"CVE-2020-15244","title":"RCE in Magento","description":"In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.","status":"published","published":"2020-10-21T20:05:20Z","modified":"2024-08-04T13:08:23.228Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502","CWE-74"],"updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-1431","description":"In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.","status":"published","published":"2020-10-21T20:05:20Z","modified":"2024-08-04T13:08:23Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-jrgf-vfw2-hj26","title":"RCE via PHP Object injection via SOAP Requests","description":"### Impact\nThis vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.\n\n### Patches\nThe latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved\n\n### Credits\nCredit to Luke Rodgers for reporting","status":"published","published":"2020-10-30T17:06:06Z","modified":"2023-02-01T05:05:02Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-502"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2020-15244","description":"In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.","status":"published","published":"2020-10-21T20:15:13.443Z","modified":"2026-06-17T02:56:20.827Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74","CWE-502"],"updated_at":"2026-11-02T14:06:20.704992Z"}],"osv":[{"id":"CVE-2020-15244","description":"In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.","status":"published","published":"2020-10-21T20:15:13.443Z","modified":"2026-10-24T10:50:37.681198806Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-jrgf-vfw2-hj26","title":"RCE via PHP Object injection via SOAP Requests","description":"### Impact\nThis vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.\n\n### Patches\nThe latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved\n\n### Credits\nCredit to Luke Rodgers for reporting","status":"published","published":"2020-10-30T17:06:06Z","modified":"2026-07-08T06:01:01.056007395Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502","CWE-74"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}