Description

In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

Remediation

References

CVE-2019-8231

Related Vulnerabilities

WordPress Plugin BuddyPress Activity Plus Multiple Vulnerabilities (1.6.1)

Jenkins Improper Input Validation Vulnerability (CVE-2018-1999001)

WordPress Plugin FV Flowplayer Video Player Cross-Site Scripting (7.5.2.727)

WordPress Plugin WP Auctions 'wpa_id' Parameter SQL Injection (1.8.8)

PHP Other Vulnerability (CVE-2006-1017)

Severity

High

Classification

CVE-2019-8231 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities