Openmage
CVE-2021-32758
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.
AnalysisAI
OpenMage Magento LTS is an alternative to the Magento CE official releases. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-91. OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched. Affected products include: Openmage.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Magento LTS is the official OpenMage LTS codebase. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Rated critical severity (CVSS 9.8), th
Remote code execution in OpenMage Magento LTS versions before 20.17.0 allows authenticated attackers to upload executabl
Remote code execution in OpenMage Magento LTS versions prior to 20.17.0 allows unauthenticated attackers to execute arbi
OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Inte
OpenMage LTS is an e-commerce platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
OpenMage magento-lts is an alternative to the Magento CE official releases. Rated high severity (CVSS 7.2), this vulnera
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Rated high severity (CVSS 7.2), this v
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap cr
Magento LTS prior to version 20.17.0 allows authenticated attackers to access private wishlist items from other users vi
Magento-lts versions prior to 20.16.1 expose the admin panel URL through improper handling of the X-Original-Url header
OpenMage LTS Dataflow module prior to version 20.17.0 allows authenticated administrators to read arbitrary files via a
Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today