TI-2015-03048 Aliases CVE-2015-3457 GHSA-jgv4-w58m-q2g2

Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote…

MEDIUM 44CWE-287Published 2015-04-29 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Partial · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.

Why it matters now

EPSS 0.25054 97th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:magento:magento:1.9.1.0::::community:::	1.9.1.0	Vulnerable	Magento
cpe:2.3:a:magento:magento:1.14.1.0::::enterprise:::	1.14.1.0	Vulnerable	Magento

cpe:2.3:a:magento:magento:1.9.1.0:*:*:*:community:*:*:* Versions 1.9.1.0 Vulnerable ·Magento
cpe:2.3:a:magento:magento:1.14.1.0:*:*:*:enterprise:*:*:* Versions 1.14.1.0 Vulnerable ·Magento

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2015-3457
2026-10-03 Alias added: GHSA-jgv4-w58m-q2g2

References

Patch 1

http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability

Other 1

http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/

TI-2016-03411 Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection… CVSS 3.0CRITICAL 9.8
TI-2021-04135 Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution CVSS 3.1MEDIUM 4.8
TI-2019-05058 SQL injection in Magento Open Source CVSS 3.0CRITICAL 9.8
TI-2015-01273 SQL injection vulnerability in the getCsvFile function in the… CVSS 2.0MEDIUM 6.5
TI-2022-15170 Adobe Commerce Stored XSS Arbitrary code execution CVSS 3.1MEDIUM 4.8
TI-2020-03231 Deserialization of untrusted data in Adobe Magento CVSS 3.1CRITICAL 9.8

See all 220 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences