CVE-2020-5777
Description
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dweeves/magmiPackagist | < 0.7.24 | 0.7.24 |
Affected products
2- Range: All versions prior to version 0.7.24
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-g475-pch5-6wvvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-5777ghsaADVISORY
- www.tenable.com/security/research/tra-2020-51nvdThird Party AdvisoryWEB
- github.com/dweeves/magmi-git/commit/dde71de5cfd505fe78e5caf21d6531b61450a16fghsaWEB
News mentions
0No linked articles in our index yet.