CVE-2020-26285 - CVE House

Back to Database

Status published High CVE-2020-26285

Widget instances allows a hacker to inject an executable file on the server on OpenMage

8.7 CVSS

Vulnerability Description

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26285

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenMage

View All →

OpenMage is vulnerable to XSS in Admin Notifications

Magento vulnerable to stored XSS in theme config fields

Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

Magento LTS's guest order "protect code" can be brute-forced too easily

OpenMage LTS has DoS vulnerability in MaliciousCode filter

Affected Vendor

OpenMage

View all reports →

Affected Software

magento-lts

Vulnerable Versions:

< 19.4.10, >= 20.0.0, < 20.0.5

Timeline

Official Publish: January 21st, 2021

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation