Description

In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

Remediation

References

CVE-2019-8231

Related Vulnerabilities

PHP CVE-2009-3559 Vulnerability (CVE-2009-3559)

Apache Traffic Server Uncontrolled Resource Consumption Vulnerability (CVE-2019-9512)

Oracle Application Server Other Vulnerability (CVE-2007-2123)

WordPress Plugin WP Docs Multiple Vulnerabilities (1.1.7)

TYPO3 Improper Input Validation Vulnerability (CVE-2012-1608)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CVE-2019-8231