Description
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution.
Remediation
References
Related Vulnerabilities
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2356)
Lighttpd Out-of-bounds Write Vulnerability (CVE-2022-22707)
WordPress Plugin Bookshelf Cross-Site Scripting (2.0.4)
WordPress Plugin Responsive Owl Carousel for Elementor Local File Inclusion (1.2.0)
Apache Traffic Server Improper Input Validation Vulnerability (CVE-2017-5660)