Описание
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
Ссылки
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 19.4.22 (исключая)Версия от 20.0.0 (включая) до 20.0.19 (исключая)
Одно из
cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*
cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*
EPSS
Процентиль: 52%
0.00293
Низкий
7.2 High
CVSS3
Дефекты
CWE-77
CWE-434
Связанные уязвимости
CVSS3: 7.2
github
около 3 лет назад
DataFlow upload remote code execution vulnerability
EPSS
Процентиль: 52%
0.00293
Низкий
7.2 High
CVSS3
Дефекты
CWE-77
CWE-434