Description
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution.
Remediation
References
Related Vulnerabilities
WordPress Plugin Menu Swapper Cross-Site Request Forgery (1.1.0.2)
Moodle CVE-2011-4301 Vulnerability (CVE-2011-4301)
MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-10268)
WordPress Plugin HashThemes Demo Importer Security Bypass (1.1.1)
Grafana URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2022-29170)