CVE-2020-15151 Observable Timing Discrepancy in OpenMage LTS

2020-08-1918:10:13

CWE-203

GitHub_M

www.cve.org

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.2%

JSON

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the fromkey protection in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe’s CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

CNA Affected

[
  {
    "product": "magento-lts",
    "vendor": "OpenMage",
    "versions": [
      {
        "status": "affected",
        "version": "< 19.4.6\""
      },
      {
        "status": "affected",
        "version": ">= 20.0.0, < 20.0.2"
      }
    ]
  }
]