CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21426 – Fixes a bug in Zend Framework's Stream HTTP Wrapper
https://notcve.org/view.php?id=CVE-2021-21426
Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework 3. The vulnerability was assigned CVE-2021-3007 in Zend Framework. Magento-lts es una alternativa de soporte a largo plazo a Magento Community Edition (CE). • https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m496-x567-f98c • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15244 – RCE in Magento
https://notcve.org/view.php?id=CVE-2020-15244
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4. En Magento (paquete rubygems openmage/magento-lts) versiones anteriores a 19.4.8 y 20.0.4, un usuario administrador puede generar credenciales soap que pueden ser usadas para activar una RCE por medio de la inyección de objetos PHP mediante atributos de producto y un producto. El problema está parcheado en las versiones 19.4.8 y 20.0.4 • https://github.com/OpenMage/magento-lts https://github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-502: Deserialization of Untrusted Data •
CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15151 – Observable Timing Discrepancy in OpenMage LTS
https://notcve.org/view.php?id=CVE-2020-15151
OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2. OpenMage LTS versiones anteriores a 19.4.6 y 20.0.2, permite a atacantes evitar la "fromkey protection" en la interfaz de Administración y aumenta la superficie de ataque para ataques de tipo Cross Site Request Forgery. Este problema está relacionado con el CVE-2020-9690 de Adobe. • https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347a https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6 https://helpx.adobe.com/security/products/magento/apsb20-47.html • CWE-203: Observable Discrepancy CWE-352: Cross-Site Request Forgery (CSRF) •