Description
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template.
Remediation
References
Related Vulnerabilities
Oracle Application Server CVE-2009-1999 Vulnerability (CVE-2009-1999)
MySQL CVE-2018-3171 Vulnerability (CVE-2018-3171)
SharePoint CVE-2020-0850 Vulnerability (CVE-2020-0850)
WordPress Plugin Yet Another Photoblog Unspecified Vulnerability (1.10.6)
Drupal Deserialization of Untrusted Data Vulnerability (CVE-2020-28948)