Detections
Analytics

Magento Mass Importer Cross-Site Request Forgery

high Web App Scanning Plugin ID 112567

Language:

Synopsis

Magento Mass Importer Cross-Site Request Forgery

Description

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer suffers from a cross-site request forgery vulnerability, which could be used by an attacker to target a privileged user and perform malicious actions against the administration interface. The attacker could leverage this vulnerabity to achieve remote code execution on the target application.

Solution

No patch is available for this vulnerability. Therefore, it is recommended to remove the software.

See Also

https://github.com/dweeves/magmi-git/

Plugin Details

Severity: High

ID: 112567

Type: remote

Published: 8/27/2020

Updated: 9/7/2021

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-5776

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2020-5776

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information

CVE: CVE-2020-5776