VulnerabilityModified

CVE-2015-6497

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to…

HIGH 8.8EPSS 7.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (7.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 7.37% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: magento/magento
Source: cve@mitre.org

References

http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.htmlExploit, Third Party Advisory
http://karmainsecurity.com/KIS-2015-04Exploit, Third Party Advisory
http://magento.com/security/patches/supee-6482Vendor Advisory
http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Sep/48Exploit, Mailing List, Third Party Advisory
http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.htmlExploit, Third Party Advisory
http://karmainsecurity.com/KIS-2015-04Exploit, Third Party Advisory
http://magento.com/security/patches/supee-6482Vendor Advisory
http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Sep/48Exploit, Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.