CVE-2017-7391

MEDIUM EXPLOITED IN THE WILD NUCLEI

Magmi 0.7.22 - XSS

Title source: llm

Description

A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Nuclei Templates (1)

Magmi 0.7.22 - Cross-Site Scripting

MEDIUMby pikpikcu

Shodan: http.component:"magento"

References (3)

[Issue Tracking, Patch, Third Party Advisory] https://github.com/dweeves/magmi-git/issues/522

[Issue Tracking, Patch, Third Party Advisory] https://github.com/dweeves/magmi-git/pull/525

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97311

Scores

CVSS v3 6.1

EPSS 0.0889

EPSS Percentile 92.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitation Intel

VulnCheck KEV 2020-05-18

InTheWild.io 2020-05-06

Classification

CWE

CWE-79

Status published

Affected Products (3)

magmi_project/magmi

dweeves/magmi < 0.7.24Packagist

n/a/n/a

Timeline

Published Apr 01, 2017

Tracked Since Feb 18, 2026