CVE-2014-8770
Last modified
CVE-2014-8770 is a vulnerability of currently unknown severity. Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.. EPSS estimates a 6.54% chance of exploitation in the next 30 days.
Description
Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Magmi Project | Magmi | <= 0.7.17a |
References
- http://osvdb.org/show/osvdb/113848Broken Link
- http://www.exploit-db.com/exploits/35052Exploit, Third Party Advisory, VDB Entry
- http://osvdb.org/show/osvdb/113848Broken Link
- http://www.exploit-db.com/exploits/35052Exploit, Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-8770?
How severe is CVE-2014-8770?
How do I fix CVE-2014-8770?
Are you affected by CVE-2014-8770?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST