Description
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenMage | magento-lts | < 19.4.8, >= 20.0.0, < 20.0.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | openmage/magento-lts | < 19.4.8 | 19.4.8 | GHSA-jrgf-vfw2-hj26 |
| Packagist | openmage/magento-lts | >= 20.0.0, < 20.0.4 | 20.0.4 | GHSA-jrgf-vfw2-hj26 |