CVE-2020-15151

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-203 CWE-352

Affected software

Vendor	Product	Versions
OpenMage	magento-lts	< 19.4.6"; >= 20.0.0, < 20.0.2

References

https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347aPatch, Third Party Advisory
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6Third Party Advisory
https://helpx.adobe.com/security/products/magento/apsb20-47.htmlRelease Notes, Vendor Advisory
https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347aPatch, Third Party Advisory
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6Third Party Advisory
https://helpx.adobe.com/security/products/magento/apsb20-47.htmlRelease Notes, Vendor Advisory

Timeline

Published: Aug 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151529.1ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.1 CVE-2020-151539.8Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for det CVE-2020-151547.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thi CVE-2020-151557.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thi CVE-2020-151568.1In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post CVE-2020-151576.1In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container ima CVE-2020-151589.8In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happ CVE-2020-151597.6baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as CVE-2020-15167.8An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerabilit CVE-2020-151609.8PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page CVE-2020-151616.1In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The pro CVE-2020-151625.4In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people