Back to Database
Status published
High
CVE-2020-15151
Observable Timing Discrepancy in OpenMage LTS
Vulnerability Description
OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15151
Credits & Attribution
No credits recorded in the NVD database.
References
More from OpenMage
View All →CVE-2025-64174
OpenMage is vulnerable to XSS in Admin Notifications
Medium
4.6
CVE-2025-27400
Magento vulnerable to stored XSS in theme config fields
Low
2.9
CVE-2024-41676
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Medium
4.1
CVE-2023-41879
Magento LTS's guest order "protect code" can be brute-forced too easily
High
7.5
CVE-2023-23617
OpenMage LTS has DoS vulnerability in MaliciousCode filter
Medium
4.9
Affected Vendor
OpenMage
View all reports →Affected Software
magento-lts
Vulnerable Versions:
< 19.4.6", >= 20.0.0, < 20.0.2
Timeline
Official Publish:
August 19th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N