Openmage

openmage

23 CVEs • 3 products

Products (3)

Click to collapse

Toggle

Openmage Long Term Support

openmage_long_term_support

CVEs (23)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-26252 1Openmage 1Openmage Jun 17, 2026 Jan 20, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permissio...Show more OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.Show less
CVE-2020-15244 1Openmage 1Magento Jun 17, 2026 Oct 21, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a...Show more In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.Show less
CVE-2020-15151 2Magento Openmage 2Magento Openmage Long Term Support Jun 17, 2026 Aug 20, 2020 N/A· v4 8.0 HIGH· v3 4.0 MEDIUM· v2 OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related...Show more OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.Show less