CVE-2020-26285

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-26285
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26285.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-26285
Aliases
  • GHSA-hj6w-xrv3-wjj9
Published
2021-01-21T14:15:12Z
Modified
2026-10-20T10:52:56Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

References

Affected packages

Git / github.com/openmage/magento-lts

Affected ranges

Type
GIT
Repo
https://github.com/openmage/magento-lts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f0b8bba9820b6f21e9eca4f1563f08c40b5a8c45
Introduced
16c8e84ddaf5d54eef1e025a241bdd5f9a60bd6f
Fixed
f7b3c521d9b8d0243aaf2d28cd07650442aec345
Fixed
4132668f5009f17456fe644742026f56d2297586
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "19.4.10"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:*",
            "range":  [
                {
                    "introduced":  "20.0.0"
                },
                {
                    "fixed":  "20.0.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "4132668f5009f17456fe644742026f56d2297586"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v19.4.10",
            "range":  [
                {
                    "fixed":  "f0b8bba9820b6f21e9eca4f1563f08c40b5a8c45"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.2.0
1.2.0.1
1.2.0.2
1.2.0.3
1.2.1
1.2.1.2
1.3.0
1.3.1
1.3.1.1
1.3.2
1.3.2.1
1.3.2.2
1.3.2.3
1.3.2.4
1.4.0.0
1.4.0.0-alpha1
1.4.0.0-alpha2
1.4.0.0-alpha3
1.4.0.0-beta1
1.4.0.0-rc1
1.4.0.1
1.4.1.0
1.4.1.1
1.4.2.0
1.5.0.0
1.5.0.0-alpha1
1.5.0.0-alpha2
1.5.0.0-beta1
1.5.0.0-beta2
1.5.0.0-rc1
1.5.0.0-rc2
1.5.0.1
1.5.1.0
1.6.0.0
1.6.0.0-alpha1
1.6.0.0-beta1
1.6.0.0-rc1
1.6.0.0-rc2
1.6.1.0
1.7.0.0
1.7.0.1
1.7.0.2
1.8.1.0
1.9.0.0
1.9.0.1
1.9.1.0-lts
1.9.1.1
v19.*
v19.4.0
v19.4.1
v19.4.2
v19.4.3
v19.4.4
v19.4.5
v19.4.6
v19.4.7
v19.4.8
v19.4.9
v20.*
v20.0.0
v20.0.1
v20.0.2
v20.0.3
v20.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26285.json"