GitHub Advisoryadvisory · Packagist

GHSA-27v2-398x-f74x MAGMI cross-site scripting (XSS)

MEDIUM Published 2022-05-13 Modified 2024-04-24 Official page ↗
Aliases
CVE-2015-2068
Ecosystem
Packagist
Packages
dweeves/magmi
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-04-24

Affected packages

• Packagist dweeves/magmi: < 0.7.22 → fixed in 0.7.22

Description

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.

Related

Alias · CVE (1)

  • CVE-2015-2068 Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References