There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default
    credentials in the event there is a database connection failure. A remote attacker can trigger this
    connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web
    server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at
    least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use
    default magmi:magmi basic authentication to remotely bypass authentication. (CVE-2020-5777)

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer versions before 0.7.24 suffer from a remote authentication bypass vulnerability by exhausting the database connections pool and then allowing an attacker to gain access to the administration interface. The attacker could leverage this vulnerability to perform remote code execution on the target application.

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer suffers from a cross-site request forgery vulnerability, which could be used by an attacker to target a privileged user and perform malicious actions against the administration interface. The attacker could leverage this vulnerabity to achieve remote code execution on the target application.

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. The purpose of this software is to help Magento websites administrators to manage their catalog through a dedicated web interface. By directly accessing the Magmi URL with no authentication required, an attacker could achieve a remote code execution on the target application or other unintended operations.

ID	Name	Product	Family	Published	Updated	Severity
414845	SCA: security update for dweeves/magmi (GHSA-g475-pch5-6wvv)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	critical
414845	SCA: security update for dweeves/magmi (GHSA-g475-pch5-6wvv)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	critical
112568	Magento Mass Importer < 0.7.24 Remote Authentication Bypass	Web App Scanning	Component Vulnerability	8/27/2020	9/7/2021	critical
112567	Magento Mass Importer Cross-Site Request Forgery	Web App Scanning	Component Vulnerability	8/27/2020	9/7/2021	high
112571	Magento Mass Importer Unauthenticated Access	Web App Scanning	Component Vulnerability	8/28/2020	9/7/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical