Observable Timing Discrepancy in OpenMage LTS
Priority LOW 37CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure, Tampering
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-203 and CWE-352.
Summary
OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.
Why it matters now
EPSS 0.00931 60th percentileScored 2026-11-07
Fix Fixed magento-lts (OpenMage): 20.0.2openmage/magento-lts (Packagist): 19.4.6, 20.0.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenMage | magento-lts | < 19.4.6"; 20.0.0 to before 20.0.2 | 20.0.2 | Patch available | CNA |
| — | openmage/magento-lts (Packagist) | before 19.4.6 | 19.4.6 | Patch available | GHSA-crf2-xm6x-46p6 |
| — | openmage/magento-lts (Packagist) | 20.0.0 to before 20.0.2 | 20.0.2 | Patch available | GHSA-crf2-xm6x-46p6 |
- magento-lts VendorOpenMage Affected < 19.4.6"; 20.0.0 to before 20.0.2 Fixed in 20.0.2 Patch available CNA
- openmage/magento-lts (Packagist) Vendor— Affected before 19.4.6 Fixed in 19.4.6 Patch available GHSA-crf2-xm6x-46p6
- openmage/magento-lts (Packagist) Vendor— Affected 20.0.0 to before 20.0.2 Fixed in 20.0.2 Patch available GHSA-crf2-xm6x-46p6
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openmage:openmage_long_term_support:*:*:*:*:*:*:*:* | before 19.4.6; 20.0.0 to before 20.0.2 | Vulnerable | OpenMage |
| cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* | up to 2.3.5 | Vulnerable | Magento |
| cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* | up to 2.3.5 | Vulnerable | Magento |
- cpe:2.3:a:openmage:openmage_long_term_support:*:*:*:*:*:*:*:* Versions before 19.4.6; 20.0.0 to before 20.0.2 Vulnerable ·OpenMage
- cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* Versions up to 2.3.5 Vulnerable ·Magento
- cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* Versions up to 2.3.5 Vulnerable ·Magento
Remediation
- Fix · CNA magento-lts (OpenMage) Fixed in 20.0.2
- Fix · GHSA-crf2-xm6x-46p6 openmage/magento-lts (Packagist) Fixed in 19.4.6 Advisory →
- Fix · GHSA-crf2-xm6x-46p6 openmage/magento-lts (Packagist) Fixed in 20.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15151
- 2026-10-03 Alias added: GHSA-crf2-xm6x-46p6
References
Advisory 3
Sources
- CVE-2020-15151 · CVE Program
- CVE-2020-15151 · NVD
- FIRST EPSS
- GHSA-crf2-xm6x-46p6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences