CVE-2020-15244: RCE in Magento

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-21 · updated 2026-06-17
Weakness: CWE-74

Description

In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.

Affected products

OpenMage magento-lts: through 19.4.8; from 20.0.0 before 20.0.4 — fixed in 20.0.4

How to fix

Upgrade to a fixed version: OpenMage magento-lts 20.0.4. Check the vendor advisory for mitigations.

References

https://github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26
https://github.com/OpenMage/magento-lts
https://github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26

Get alerted when CVE-2020-15244 or the next vulnerability affects your stack