Detections
Analytics

Magento Mass Importer Unauthenticated Access

critical Web App Scanning Plugin ID 112571

Language:

Synopsis

Magento Mass Importer Unauthenticated Access

Description

Magento Mass Importer (Magmi) is a Magento database client used to perform raw bulk operations on the models of the online store. The purpose of this software is to help Magento websites administrators to manage their catalog through a dedicated web interface. By directly accessing the Magmi URL with no authentication required, an attacker could achieve a remote code execution on the target application or other unintended operations.

Solution

Authentication should be enforced to prevent unauthorized access to the Magmi interface. However, as the Magmi application is no more maintained and contains known issues, it is recommended to disable or remove it.

See Also

https://github.com/dweeves/magmi-git/

Plugin Details

Severity: Critical

ID: 112571

Type: remote

Published: 8/28/2020

Updated: 9/7/2021

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 7.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS Score Source: Tenable

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information