CVE-2015-1398
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) ..
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 14.30% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- magento/magento
- Source
- cve@mitre.org
References
- http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/Exploit
- http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerabilityPatch, Vendor Advisory
- http://www.securitytracker.com/id/1032194
- http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/Exploit
- http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerabilityPatch, Vendor Advisory
- http://www.securitytracker.com/id/1032194
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.