漏洞描述
Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data (prefix) passed to the magmi-git-master/magmi/web/ajax_gettime.php URL.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/dweeves/magmi-git/issues/522↗github.comhttps://github.com/dweeves/magmi-git/releases/download/0.7.22/magmi_full_0.7.22.zip↗github.comhttps://github.com/dweeves/magmi-git/pull/525↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2017-7391↗github.comhttps://github.com/d4n-sec/d4n-sec.github.io↗