CVE-2020-15244

In Magento rubygems openmage/magento-lts package before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4...

CVE-2020-15244

CVE-2020-15244 affects OpenMage/magento-lts within Magento: prior to versions 19.4.8 and 20.0.4, an admin can generate SOAP credentials that enable PHP Object Injection through product attributes and a product, leading to remote code execution. The issue is patched in 19.4.8 and 20.0.4.