CVE-2020-15151: 
PHP vulnerability analysis and mitigation

OpenMage LTS before versions 19.4.6 and 20.0.2 contains a vulnerability that allows attackers to circumvent the fromkey protection in the Admin Interface, increasing the attack surface for Cross Site Request Forgery (CSRF) attacks. The vulnerability was discovered and disclosed in August 2020, affecting the OpenMage LTS e-commerce platform, which is an alternative to the Magento Community Edition (GitHub Advisory).

The vulnerability stems from an observable timing discrepancy in the form key validation process. The issue is related to Adobe's CVE-2020-9690 and involves improper validation of the secret key parameter in the admin interface. The fix involved replacing a direct string comparison with a secure hash comparison using the hash_equals function to prevent timing attacks (OpenMage Commit).

The vulnerability increases the exposure to Cross Site Request Forgery (CSRF) attacks by allowing attackers to bypass the form key protection mechanism in the Admin Interface. This could potentially lead to unauthorized administrative actions being performed through CSRF attacks (GitHub Advisory).

The vulnerability has been rated as High severity. It affects the admin interface and requires an attacker to have the capability to exploit timing discrepancies in the form key validation process (GitHub Advisory).

The vulnerability has been patched in OpenMage LTS versions 19.4.6 and 20.0.2. Users are advised to upgrade to these or later versions to mitigate the risk. The fix implements secure string comparison using the hash_equals function to prevent timing-based attacks (GitHub Advisory).