MAGMI cross-site scripting (XSS)

published 2015-02-24 11 y ago modified 2026-06-17 4 mo ago also GHSA-27v2-398x-f74x , EUVD-2022-1936

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 14.0%; EPSS 14.0% chance of exploitation in 30 days, percentile 96%
public exploits: 1; Exploit-DB, plus a Nuclei check

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.

Patch / fix

fixed in 1

packagist dweeves/magmi 0.7.22

Timeline

2015-02-05 First public exploit (EDB-35996)
2015-02-24 Published

Exploit prediction

14.04% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-35996 Magento Server MAGMI Plugin - Multiple Vulnerabilities webapps, 2015-02-05
Nuclei template Magento Server Mass Importer - Cross-Site Scripting nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	dweeves/magmi	<0.7.22	0.7.22

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

exploit-db.com /exploits/35996
exploit, web, third-party-advisory, vdb-entry
packetstormsecurity.com /files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html
web, exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/74879
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2015-2068
advisory
github.com /dweeves/magmi-git
package

Sources

CVE List CVE-2015-2068
GitHub Advisory GHSA-27v2-398x-f74x
NVD CVE-2015-2068

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary