Description
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload.
Remediation
References
Related Vulnerabilities
WordPress 4.4.x PHP Object Injection (4.4 - 4.4.24)
Magento Improper Input Validation Vulnerability (CVE-2019-7898)
MySQL CVE-2022-21640 Vulnerability (CVE-2022-21640)
WordPress 'cat' Parameter SQL Injection Vulnerability (1.5 - 1.5.1.1)
WordPress Plugin NextGEN Gallery-WordPress Gallery PHP Object Injection (3.1.5)