Description
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.
Remediation
References
Related Vulnerabilities
phpMyAdmin CVE-2013-3238 Vulnerability (CVE-2013-3238)
MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-8623)
MongoDb Insufficiently Protected Credentials Vulnerability (CVE-2021-32039)
Family Connections Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-4338)
SharePoint Resource Management Errors Vulnerability (CVE-2015-0064)