medium6.1
CVE-2017-7391
Magmi XSS Vulnerability
Impact
A Cross-Site Scripting (XSS) was discovered in Magmi 0.7.22. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the `magmi-git-master/magmi/web/ajax_gettime.php` URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dweeves/magmi | <= 0.7.22 | 0.7.24 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Magmi Project | Magmi | Version 0.7.22 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/97311
- https://github.com/dweeves/magmi-git/issues/522
- https://github.com/dweeves/magmi-git/pull/525
- https://github.com/advisories/GHSA-r8vh-cm9f-rc29
- https://nvd.nist.gov/vuln/detail/CVE-2017-7391
- https://web.archive.org/web/20210125191718/http://www.securityfocus.com/bid/97311
- https://github.com/dweeves/magmi-git/commit/a9566b141b58bf40a9dd904a74e6efcc225a28a3