CVE-2015-3458 Code injection in n/a
Remote administrators can execute arbitrary PHP code via phar stream wrapper in Magento template paths, leading to potential system compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-3458?
CVE-2015-3458 is a medium-severity code injection vulnerability in Magento Magento, published on 29 Apr 2015. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Weakness: CWE-264
Which versions are affected by CVE-2015-3458?
It affects 1 product.
Products include Magento Magento.
How do I fix CVE-2015-3458?
No fix has been published for CVE-2015-3458 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2015-3458 being exploited?
There is no known exploitation of CVE-2015-3458 in the wild and no public exploit code.
Other vulnerabilities in Magento Magento
Sources
Also known as GHSA-wgph-6w8g-236p.