GHSA-r8vh-cm9f-rc29

Source

https://github.com/advisories/GHSA-r8vh-cm9f-rc29

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-r8vh-cm9f-rc29/GHSA-r8vh-cm9f-rc29.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r8vh-cm9f-rc29

Aliases

CVE-2017-7391

Published

2022-05-17T02:51:51Z

Modified

2024-02-16T08:04:27.777991Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Magmi XSS Vulnerability

Details

A Cross-Site Scripting (XSS) was discovered in Magmi 0.7.22. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the magmi-git-master/magmi/web/ajax_gettime.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Database specific

{
    "nvd_published_at": "2017-04-01T02:59:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-27T22:32:19Z"
}

References

Affected packages

Packagist / dweeves/magmi

Package

Name: dweeves/magmi
Purl: pkg:composer/dweeves/magmi

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.24

Affected versions

0.*

0.7.19a

0.7.19

0.7.20

0.7.21

0.7.22

Database specific

{
    "last_known_affected_version_range": "<= 0.7.22"
}