Authentication flaw

2015-04-2922:59:00

PRIOn knowledge base

www.prio-n.com

7.5 High

AI Score

Confidence

Low

0.498 Medium

EPSS

Percentile

97.5%

JSON

Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.

CPENameOperatorVersion
magentoeq1.9.1.0
magentoeq1.14.1.0

CPE	Name	Operator	Version
	magento	eq	1.9.1.0
	magento	eq	1.14.1.0

References

magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability

www.securityfocus.com/bid/74420

www.securitytracker.com/id/1032230

blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/