Vulnerability advisory

GHSA-jrgf-vfw2-hj26

RCE via PHP Object injection via SOAP Requests

Published Oct 30, 2020Updated Jul 8, 2026OSV record ↗

Also known as CVE-2020-15244

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected versions

openmage/magento-lts Packagist

All openmage/magento-lts advisories →

Affected	Fixed in
All versions before 19.4.8	`19.4.8`Advisories →
Also listed as affected (16) `1.9.1.1` `1.9.2.0` `1.9.2.1` `1.9.2.2` `1.9.2.3` `1.9.2.4` `1.9.3.0` `1.9.3.1` `v19.4.0` `v19.4.1` `v19.4.2` `v19.4.3` `v19.4.4` `v19.4.5` `v19.4.6` `v19.4.7`
`20.0.0` to before 20.0.4	`20.0.4`Advisories →
Also listed as affected (4) `v20.0.0` `v20.0.1` `v20.0.2` `v20.0.3`

Description

Impact

This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

GHSA-jrgf-vfw2-hj26

Affected versions

openmage/magento-lts Packagist

Description

Impact

Patches

Credits

References