PatchTheCVEmagmi vulnerabilities and fixes
Recent CVEs affecting magmi, with upgrade or downgrade steps. 6 tracked.
magmi has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2020-09-01. Highest priority: CVE-2020-5777 (score 64/100).
- CVE-2020-5777 CRITICAL 9.8 UPGRADE MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default creden
- CVE-2020-5776 HIGH 8.8 MITIGATE Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens
- CVE-2017-7391 MEDIUM 6.1 DOWNGRADE A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'
- CVE-2015-2068 MEDIUM 4.3 MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magent
- CVE-2015-2067 MEDIUM 5.0 MITIGATE Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin f
- CVE-2014-8770 HIGH 9.0 UPGRADE Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin
FAQ
How do I fix magmi vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is magmi being exploited right now?
None of the tracked magmi CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which magmi CVE should I patch first?
CVE-2020-5777 currently ranks highest (64/100): MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default creden.