~ / search / GHSA-cv7m-wc7g-7gfp

GHSA-cv7m-wc7g-7gfp

Cross-Site Request Forgery in MAGMI

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-5776

Packages

EcosystemPackageAffectedFixed in
Packagist dweeves/magmi <= 0.7.24 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of MAGMI up to and including version 0.7.24 are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.

References

External links from the advisory. They lead to third-party sites.