OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back…
OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpenMage
- Product
- magento-lts
- CVSS v3.1
- 7.7 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
- Weakness
- CWE-346
- NVD status
- Received
Why it ranks 25 (Notable)
- CVSS v3.1 7.7 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.