Vulnerability Database

296,748

Total vulnerabilities in the database

CVE-2015-3457

Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.

Published: Apr 30, 2015
Updated: Apr 13, 2023
CVE: CVE-2015-3457
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
magento / magento	1.9.1.0	1.9.1.0.x
magento / magento	1.14.1.0	1.14.1.0.x

http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/
http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability
http://www.securityfocus.com/bid/74420
http://www.securitytracker.com/id/1032230

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo