CVE-2014-8770

EPSS 13.2%

MAGMI plugin for Magento Unsafe File Upload

Published: 5/14/2022Modified: 11/8/2023

Description

Unrestricted file upload vulnerability in `magmi/web/magmi.php` in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in `magmi/plugins/`.

Affected packages (1)

References (3)