Description

In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.

Remediation

References

CVE-2019-8230

Related Vulnerabilities

Elgg Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2021-3964)

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-2064)

MySQL Integer Overflow or Wraparound Vulnerability (CVE-2017-3599)

WordPress Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Vulnerability (CVE-2020-4049)

MySQL CVE-2018-2762 Vulnerability (CVE-2018-2762)

Severity

High

Classification

CVE-2019-8230 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities