PT-2015-5265 · Magento · Magento Community Edition+1

Netanel Rubin · Publicado 2015-04-29 · Atualizado 2015-05-12 · CVE-2015-1398

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magento Community Edition versions 1.9.1.0 Magento Enterprise Edition versions 1.14.1.0

Description The issue allows remote authenticated users to include and execute certain PHP files. This can be achieved via .. (dot dot) sequences in the PATH INFO to index.php or through vectors involving a block value in the directive parameter to the Cms Wysiwyg controller in the Adminhtml module. The issue is related to the blockDirective function and the auto loading mechanism.

Recommendations For Magento Community Edition version 1.9.1.0, consider restricting access to the Adminhtml module until a patch is available. For Magento Enterprise Edition version 1.14.1.0, consider disabling the Cms Wysiwyg controller as a temporary workaround until a fix is provided. Avoid using the directive parameter in the Cms Wysiwyg controller until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-1398

Produtos afetados

Magento Community Edition

Magento Enterprise Edition

Referências · 5

• 🔥 http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability · Exploit
• http://securitytracker.com/id/1032194 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1398 · Nota de Segurança
• http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1398 · Nota