GitHub Advisoryadvisory · Packagist

GHSA-c252-xc8v-mqmm MAGMI plugin for Magento Server Directory Traversal

MEDIUM Published 2022-05-13 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-2067
Ecosystem
Packagist
Packages
dweeves/magmi
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2023-07-31

Affected packages

• Packagist dweeves/magmi: <= 0.7.21 (no fix yet)

Description

Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

Related

Alias · CVE (1)

  • CVE-2015-2067 Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References