CVE-2020-15244: 
PHP vulnerability analysis and mitigation

CVE-2020-15244 affects Magento (rubygems openmage/magento-lts package) versions before 19.4.8 and 20.0.4. The vulnerability was discovered and disclosed on October 21, 2020, allowing an admin user to generate SOAP credentials that could be used to trigger Remote Code Execution (RCE) via PHP Object Injection through product attributes and a product (NVD, GitHub Advisory).

The vulnerability stems from improper validation in the SOAP API functionality, specifically related to PHP Object Injection through product attributes. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) by NIST with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. GitHub has assigned it a slightly higher CVSS score of 8.0 (HIGH) with vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (NVD).

If exploited, this vulnerability allows an authenticated administrator to execute arbitrary code on the affected system through PHP Object Injection. This could lead to complete system compromise with the ability to read, modify, or delete data, and potentially take full control of the affected server (GitHub Advisory).

The vulnerability requires an attacker to have administrative access to generate SOAP credentials, which are then used to trigger the RCE via PHP Object Injection. The attack vector is network-accessible and can be exploited remotely once the attacker has the necessary administrative privileges (NVD).

The vulnerability has been patched in versions 19.4.8 and 20.0.4 of the OpenMage Magento LTS package. Users are strongly advised to upgrade to these or later versions to protect against this vulnerability. The fix includes additional validation checks for user-defined attributes and improved security measures for SOAP credential handling (GitHub Patch).