« Volver al listado

CVE-2015-1398

Estado: ModificadaMedia (6.5)—

Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Magento — Magento

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-1398",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-04-29T22:59:01.533",
  "references": [
    {
      "url": "http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1032194",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032194",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism.  NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de salto de directorio en Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permiten a usuarios remotos autenticados incluir y ejecutar ciertos ficherso PHP a través de (1) secuencias de .. (punto punto) en PATH_INFO en index.php o (2) vectores que involucran un valor de bloque en el parámetro ___directive en el controlador Cms_Wysiwyg en el módulo Adminhtml, relacionado con la función blockDirective y el mecanismo de carga automática. NOTA: el vector 2 podría no cruzar los límites de los privilegios, como administradores podrían ya tener los privilegios para ejecutar código y subir ficheros."
    }
  ],
  "lastModified": "2026-06-17T00:22:21.757",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:magento:magento:1.9.1.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6844CE7-F5A9-41CC-BAE8-C860C36F1C14"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:1.14.1.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B9093FD-5E68-4616-BFDC-DA589FBCEDFB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}