CVE-2015-2067
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 39%
from disclosure to weapon0 days
Published on NVDFeb 24
1st PoCFeb 5
VulnCheck+2098d
exploitation probability
39%top 2% of all CVEs
observed exploitation
yesVulnCheck
3 public exploit(s)
Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Affected products
n/a · n/apublic PoCs found — 3
exploitdbwww.exploit-db.com/exploits/35996unverifiedcve_referencepacketstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.htmlunverifiedcve_referencewww.exploit-db.com/exploits/35996unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.