title: OpenMage LTS arbitrary command execution in custom layout update through blocks
description: OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
problem types: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
vendor: OpenMage
product: magento-lts
versions:
version: < 19.4.22, status: affected
version: >= 20.0.0, < 20.0.19, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]