GHSA-qpc8-m2xm-9w75

Magento Remote code execution through catalog attribute sets

At a glance

Published: 2022-05-24 17:00 UTC
Updated: 2024-01-10 21:56 UTC
CVE: CVE-2019-8231
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

Affected packages

Package	Versions
Packagist · magento/core	introduced 0, fixed 1.9.4.3

References

https://nvd.nist.gov/vuln/detail/CVE-2019-8231 ADVISORY
https://magento.com/security/patches/supee-11219 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database