CVE-2020-26252

Katalog CVE

CVSS 7.2 · High EPSS 2,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada openmage. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.

Rincian

Terbit di NVD

20 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenMage/magento-lts/commit/0786aa48bc7b618cfe37b59f45e1da3714c533c3 patch · advisory pihak ketiga
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-99m6-r53j-4hh2 advisory pihak ketiga