CVE-2015-2068 MAGMI cross-site scripting (XSS)
MediumCVSS 4.3
EPSS 14.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dweeves/magmi(Packagist) | < 0.7.22 | 0.7.22 |
| dweeves/magmi(Packagist) | = 0.7.19 | No fix listed |
| dweeves/magmi(Packagist) | = 0.7.19a | No fix listed |
| dweeves/magmi(Packagist) | = 0.7.20 | No fix listed |
| dweeves/magmi(Packagist) | = 0.7.21 | No fix listed |
| magmi project magmi | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 35996 exploit third-party-advisory vdb-entry
- 74879 third-party-advisory vdb-entry
- github.com