GHSA-qpc8-m2xm-9w75

Magento Remote code execution through catalog attribute sets

En bref

Publiée: 2022-05-24 17:00 UTC
Mise à jour: 2024-01-10 21:56 UTC
CVE: CVE-2019-8231
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

Paquets affectés

Paquet	Versions
Packagist · magento/core	introduced 0, fixed 1.9.4.3

Références

https://nvd.nist.gov/vuln/detail/CVE-2019-8231 ADVISORY
https://magento.com/security/patches/supee-11219 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database