CVE-2014-8770

2014-11-1315:00:00

mitre

www.cve.org

unrestricted file upload

magmi plugin

magento community edition

remote code execution

zip file

php file

AI Score

7.3

Confidence

High

EPSS

0.005

Percentile

75.9%

JSON

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.