p PatchFirst

CVE-2020-15151

CVE-2020-15151 · Observable Timing Discrepancy in OpenMage LTS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

CVSS 8.0 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • magento-lts

    Versions
    • < 19.4.6": Affected
    • >= 20.0.0, < 20.0.2: Affected

    No fix published

  • openmage/magento-lts Packagist

    Versions
    • 1.9.1.1
    • 1.9.2.0
    • 1.9.2.1
    • 1.9.2.2
    • 1.9.2.3
    • 1.9.2.4
    • 1.9.3.0
    • 1.9.3.1
    • v19.4.0
    • v19.4.1
    • v19.4.2
    • v19.4.3
    • v19.4.4
    • v19.4.5
    Affected ranges
    • ECOSYSTEM: < 19.4.6

    Update to 19.4.6

  • openmage/magento-lts Packagist

    Versions
    • v20.0.0
    • v20.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 20.0.0, < 20.0.2

    Update to 20.0.2

Original sources

Check your server →