Magento Mass Importer (Magmi) 是一个 Magento 数据库客户端，用于对在线商店的模型执行原始批量操作。0.7.24 之前的 Magento Mass Importer 版本会受到远程身份验证绕过漏洞的影响，方法是耗尽数据库连接池，然后允许攻击者获得管理界面的访问权限。攻击者可利用此漏洞，在目标应用程序上执行远程代码执行。

Magento Mass Importer (Magmi) は、オンラインストアのモデルでrawバルク操作を実行するために使用されるMagentoデータベースクライアントです。0.7.24 より前のバージョンの Magento Mass Importer は、データベース接続プールを使い果たし、攻撃者が管理インターフェースにアクセスできるようにすることで、リモート認証バイパスの脆弱性の影響を受けます。攻撃者がこの脆弱性を利用して、ターゲットアプリケーションでリモートコードの実行を行う可能性があります。

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer versions before 0.7.24 suffer from a remote authentication bypass vulnerability by exhausting the database connections pool and then allowing an attacker to gain access to the administration interface. The attacker could leverage this vulnerability to perform remote code execution on the target application.

Magento Mass Importer (Magmi) 是一種 Magento 資料庫用戶端，用於在網路商店的模型上執行原始大量作業。Magento Mass Importer 0.7.24 之前版本受到透過耗盡資料庫連線集區而造成的遠端驗證繞過弱點影響，這使攻擊者可以取得管理介面的存取權。攻擊者可利用此弱點，針對目標應用程式發動遠端程式碼執行攻擊。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default
    credentials in the event there is a database connection failure. A remote attacker can trigger this
    connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web
    server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at
    least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use
    default magmi:magmi basic authentication to remotely bypass authentication. (CVE-2020-5777)

ID	Name	Product	Family	Published	Updated	Severity
112568	Magento Mass Importer < 0.7.24 远程身份验证绕过	Web App Scanning	Component Vulnerability	8/27/2020	9/7/2021	critical
112568	Magento Mass Importer < 0.7.24 のリモート認証バイパス	Web App Scanning	Component Vulnerability	8/27/2020	9/7/2021	critical
112568	Magento Mass Importer < 0.7.24 Remote Authentication Bypass	Web App Scanning	Component Vulnerability	8/27/2020	9/7/2021	critical
112568	Magento Mass Importer < 0.7.24 遠端驗證繞過	Web App Scanning	Component Vulnerability	8/27/2020	9/7/2021	critical
414845	SCA: security update for dweeves/magmi (GHSA-g475-pch5-6wvv)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	critical
414845	SCA: security update for dweeves/magmi (GHSA-g475-pch5-6wvv)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical