GHSA-qpc8-m2xm-9w75

ghsaUSosv

Magento Remote code execution through catalog attribute sets

view advisory published 2022-05-24Licence: CC-BY-4.0

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-8231US	high7.2	1.41% (73rd)	—	2019-11-06
In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layou…

references

External citations — patches, advisories, analysis.

https://magento.com/security/patches/supee-11219WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-8231ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan