CVE-2015-6497 - Vulnerability Details - OpenCVE

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Magento	Magento
Php	Php

Configuration 1 [-]

AND

OR	cpe:2.3:a:magento:magento:::::community:::*
	cpe:2.3:a:magento:magento:::::enterprise:::*

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::

No data.

References

Link	Providers
http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html
http://karmainsecurity.com/KIS-2015-04
http://magento.com/security/patches/supee-6482
http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html
http://seclists.org/fulldisclosure/2015/Sep/48

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-01-15T16:49:00.000Z

Updated: 2024-08-06T07:22:22.247Z

Reserved: 2015-08-17T00:00:00.000Z

Link: CVE-2015-6497

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-01-15T17:15:13.597

Modified: 2024-11-21T02:35:05.090

Link: CVE-2015-6497

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-09-11T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-01-15T16:49:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html"}, {"tags": ["x_refsource_MISC"], "url": "http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html"}, {"tags": ["x_refsource_MISC"], "url": "http://karmainsecurity.com/KIS-2015-04"}, {"tags": ["x_refsource_MISC"], "url": "http://seclists.org/fulldisclosure/2015/Sep/48"}, {"tags": ["x_refsource_MISC"], "url": "http://magento.com/security/patches/supee-6482"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-6497", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html"}, {"name": "http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html", "refsource": "MISC", "url": "http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html"}, {"name": "http://karmainsecurity.com/KIS-2015-04", "refsource": "MISC", "url": "http://karmainsecurity.com/KIS-2015-04"}, {"name": "http://seclists.org/fulldisclosure/2015/Sep/48", "refsource": "MISC", "url": "http://seclists.org/fulldisclosure/2015/Sep/48"}, {"name": "http://magento.com/security/patches/supee-6482", "refsource": "MISC", "url": "http://magento.com/security/patches/supee-6482"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T07:22:22.247Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://karmainsecurity.com/KIS-2015-04"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2015/Sep/48"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://magento.com/security/patches/supee-6482"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-6497", "datePublished": "2020-01-15T16:49:00.000Z", "dateReserved": "2015-08-17T00:00:00.000Z", "dateUpdated": "2024-08-06T07:22:22.247Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:community:*:*:*", "matchCriteriaId": "3477C30C-8E29-40BA-B476-97B8F38F12EB", "versionEndExcluding": "1.9.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "32B8D340-3A4B-4DAE-A8C6-75B92C31EC07", "versionEndExcluding": "1.14.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "527F2580-90ED-48D4-8216-6A3C0FCA6AC0", "versionEndExcluding": "5.4.24", "vulnerable": false}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA489F21-F012-4394-908A-5D912078FC13", "versionEndExcluding": "5.5.8", "versionStartIncluding": "5.4.25", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap."}, {"lang": "es", "value": "La funci\u00f3n create en el archivo app/code/core/Mage/Catalog/Model/Product/Api/V2.php en Magento Community Edition (CE) versiones anteriores a 1.9.2.1 y Enterprise Edition (EE) versiones anteriores a 1.14.2.1, cuando es usado con PHP versiones anteriores a 5.4.24 o 5.5.8, permite a usuarios autenticados remotos ejecutar c\u00f3digo PHP arbitrario por medio del par\u00e1metro productData en index.php/api/v2_soap."}], "id": "CVE-2015-6497", "lastModified": "2024-11-21T02:35:05.090", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-01-15T17:15:13.597", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "http://karmainsecurity.com/KIS-2015-04"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://magento.com/security/patches/supee-6482"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2015/Sep/48"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "http://karmainsecurity.com/KIS-2015-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://magento.com/security/patches/supee-6482"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2015/Sep/48"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}