OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig
Summary
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and p...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| OpenMagemagento-lts |
≥ 21.0.0-beta1, < 21.0.0-beta3→ 21.0.0-beta3 |
21.0.0-beta3 |
Original description The description as published by the source.
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.
Source: CVE.org (CVE Program・cvelistV5) NVD