Vulnerability Description
Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Magmi Project | Magmi | <= 0.7.17a |
Related Weaknesses (CWE)
References
- http://osvdb.org/show/osvdb/113848Broken Link
- http://www.exploit-db.com/exploits/35052ExploitThird Party AdvisoryVDB Entry
- http://osvdb.org/show/osvdb/113848Broken Link
- http://www.exploit-db.com/exploits/35052ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2014-8770?
CVE-2014-8770 is a vulnerability with a CVSS score of 9.0 (HIGH). Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users t...
How severe is CVE-2014-8770?
CVE-2014-8770 has been rated HIGH with a CVSS base score of 9.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-8770?
Check the references section above for vendor advisories and patch information. Affected products include: Magmi Project Magmi.