CVE-2015-2068

Опубликовано: 24 фев. 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.

Ссылки

http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/35996
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/74879
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/35996
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/74879
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:magmi_project:magmi:-:*:*:*:*:magento_server:*:*

EPSS

Процентиль: 90%

0.05406

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-27v2-398x-f74x

github

больше 3 лет назад

MAGMI cross-site scripting (XSS)