GitHub Advisoryadvisory · Packagist

GHSA-qpc8-m2xm-9w75 Magento Remote code execution through catalog attribute sets

HIGH Published 2022-05-24 Modified 2024-01-10 Official page ↗
Aliases
CVE-2019-8231
Ecosystem
Packagist
Packages
magento/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-01-10

Affected packages

• Packagist magento/core: < 1.9.4.3 → fixed in 1.9.4.3

Description

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

Related

Alias · CVE (1)

  • CVE-2019-8231 In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References