Threats tagged 'ghsa-4wpp-3r54-34hj'

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an insufficient session expiration vulnerability. The issue arises because the session renewal function does not verify if the API user is active, and REST OAuth authorization does not check admin user activity status. This allows attackers with existing SOAP/XML-RPC sessions or OAuth tokens to maintain API access even after user deactivation or API key rotation, enabling unauthorized reading and modification of customer, order, and catalog data.