CVE-2020-15151

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

• CWE-203
• CWE-352

• https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347aPatch, Third Party Advisory
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6Third Party Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-47.htmlRelease Notes, Vendor Advisory
• https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347aPatch, Third Party Advisory
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6Third Party Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-47.htmlRelease Notes, Vendor Advisory

Published

Aug 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15146In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2…8.8
• CVE-2020-15147Red Discord Bot before versions 3.3.12 and 3.4 has a Remote …8.5
• CVE-2020-15148Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to …10
• CVE-2020-15149NodeBB before version 1.14.3 has a bug introduced in version…9.9
• CVE-2020-1515An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15150There is a vulnerability in Paginator (Elixir/Hex package) w…9.8
• CVE-2020-15152ftp-srv is an npm package which is a modern and extensible F…9.1
• CVE-2020-15153Ampache before version 4.2.2 allows unauthenticated users to…9.8
• CVE-2020-15154baserCMS 4.3.6 and earlier is affected by Cross Site Scripti…7.3
• CVE-2020-15155baserCMS 4.3.6 and earlier is affected by Cross Site Scripti…7.3
• CVE-2020-15156In nodebb-plugin-blog-comments before version 0.7.0, a logge…8.1
• CVE-2020-15157In containerd (an industry-standard container runtime) befor…6.1