Just as Magento 1 reaches end of life, attackers are exploiting a vulnerability in a Magento plugin from 2017. Site owners should prepare to migrate their stores immediately.

CVE-2017-7391: Vulnerability in Magento Mass Import (MAGMI) Plugin Exploited in the Wild

A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to
    insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-
    master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a
    browser in the context of the vulnerable website. (CVE-2017-7391)

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer versions before 0.7.23 suffer from a cross-site scripting vulnerability through the prefix parameter of the /magmi/web/ajax_gettime.php URL, allowing an attacker to inject HTML or javascript code in the context of the vulnerable application. The attacker could leverage this vulnerability to target Magento privileged users and to gain access to sensitive information or to perform modifications on behalf of this user.

ID	Name	Product	Family	Severity
432925	SCA: security update for dweeves/magmi (GHSA-r8vh-cm9f-rc29)	Tenable Cloud Security	SCA Checks	medium
432925	SCA: security update for dweeves/magmi (GHSA-r8vh-cm9f-rc29)	Tenable Self-Hosted Container Security	SCA Checks	medium
112441	Magento Mass Importer < 0.7.23 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2017-7391

medium

Tenable Plugins

medium

medium

medium