OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because…
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpenMage
- Product
- magento-lts
- CVSS v3.1
- 4.9 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-178
- NVD status
- Received
Why it ranks 18 (Routine)
- CVSS v3.1 4.9 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.