~ / search / GHSA-qpc8-m2xm-9w75

GHSA-qpc8-m2xm-9w75

Magento Remote code execution through catalog attribute sets

Source: GitHub Advisory Database (reviewed) High CVE-2019-8231

Packages

EcosystemPackageAffectedFixed in
Packagist magento/core < 1.9.4.3 1.9.4.3

Details

As written in the advisory (Markdown source, shown as plain text).

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

References

External links from the advisory. They lead to third-party sites.