« Volver al listado

CVE-2015-3457

Estado: ModificadaMedia (5)—

Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Magento — Magento

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-3457",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-04-29T22:59:03.253",
  "references": [
    {
      "url": "http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74420",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1032230",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74420",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032230",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter."
    },
    {
      "lang": "es",
      "value": "Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permite a atacantes remotos eludir la autenticación a través del parámetro reenviado."
    }
  ],
  "lastModified": "2026-06-17T00:25:57.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:magento:magento:1.9.1.0:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6844CE7-F5A9-41CC-BAE8-C860C36F1C14"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:1.14.1.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B9093FD-5E68-4616-BFDC-DA589FBCEDFB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}