Skip to content
Fencer Vulns
critical 9.8

CVE-2020-5777 in the critical feed json

Authentication bypass in MAGMI

published 2020-09-01 6 y ago modified 2026-06-17 4 mo ago also GHSA-g475-pch5-6wvv , EUVD-2021-1072

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
23.3%
EPSS 23.3% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known, plus a Nuclei check

Summary

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication.

Patch / fix

  • packagist dweeves/magmi 0.7.24
  • magmi_project magmi 0.7.24

Exploit prediction

23.30% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Magento Mass Importer <0.7.24 - Remote Auth Bypass nuclei detection template

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist dweeves/magmi
<0.7.24
0.7.24

Affected products

  • n/a MAGMI

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.