Description

Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.

Remediation

References

CVE-2015-3457

Related Vulnerabilities

WordPress Plugin YITH PayPal Express Checkout for WooCommerce Security Bypass (1.2.5)

Serendipity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-1386)

WordPress Plugin Twitter Button by BestWebSoft Cross-Site Scripting (2.54)

WordPress Plugin CSV Importer Multiple Unspecified Vulnerabilities (0.3.7)

WordPress Plugin Double Opt-In for Download SQL Injection (2.0.9)

Severity

Medium

Classification

CVE-2015-3457 CWE-287

Tags

Missing Update Known Vulnerabilities