GitHub Advisoryadvisory · Packagist

GHSA-cv7m-wc7g-7gfp Cross-Site Request Forgery in MAGMI

MEDIUM Published 2021-05-06 Modified 2021-05-05 Official page ↗
Aliases
CVE-2020-5776
Ecosystem
Packagist
Packages
dweeves/magmi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2021-05-05

Affected packages

• Packagist dweeves/magmi: <= 0.7.24 (no fix yet)

Description

All versions of MAGMI up to and including version 0.7.24 are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.

Related

Alias · CVE (1)

  • CVE-2020-5776 Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References