CVE-2014-8770
MAGMI plugin for Magento Unsafe File Upload
EPSS 6.5%
Description
Unrestricted file upload vulnerability in `magmi/web/magmi.php` in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in `magmi/plugins/`.
How to fix CVE-2014-8770
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- Packagist/dweeves/magmi—no fix listed
Is CVE-2014-8770 being exploited?
Moderate — EPSS is 6.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- from 0, <= 0.7.17a