Vulnerability Description
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Magento | Magento | < 1.9.2.1 |
| Php | Php | < 5.4.24 |
Related Weaknesses (CWE)
References
- http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.htmlExploitThird Party Advisory
- http://karmainsecurity.com/KIS-2015-04ExploitThird Party Advisory
- http://magento.com/security/patches/supee-6482Vendor Advisory
- http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.htmlExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2015/Sep/48ExploitMailing ListThird Party Advisory
- http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.htmlExploitThird Party Advisory
- http://karmainsecurity.com/KIS-2015-04ExploitThird Party Advisory
- http://magento.com/security/patches/supee-6482Vendor Advisory
- http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.htmlExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2015/Sep/48ExploitMailing ListThird Party Advisory
FAQ
What is CVE-2015-6497?
CVE-2015-6497 is a vulnerability with a CVSS score of 8.8 (HIGH). The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.2...
How severe is CVE-2015-6497?
CVE-2015-6497 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-6497?
Check the references section above for vendor advisories and patch information. Affected products include: Magento Magento, Php Php.