CVE-2015-1398 Path traversal in n/a
Authenticated attackers can exploit directory traversal flaws in Magento to include and execute arbitrary PHP files, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-1398?
CVE-2015-1398 is a medium-severity path traversal vulnerability in Magento Magento, published on 29 Apr 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
Weakness: CWE-22
Which versions are affected by CVE-2015-1398?
It affects 1 product.
Products include Magento Magento.
How do I fix CVE-2015-1398?
No fix has been published for CVE-2015-1398 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2015-1398 being exploited?
There is no known exploitation of CVE-2015-1398 in the wild and no public exploit code.
Other vulnerabilities in Magento Magento
Sources
Also known as GHSA-424c-xcc5-xgcj.