Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2020-15151

Observable Timing Discrepancy in OpenMage LTS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenMage magento-lts

  • < 19.4.6"affected
  • >= 20.0.0, < 20.0.2affected

References