Code injection

2019-11-0600:15:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.6%

JSON

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML.

CPENameOperatorVersion
magentoge1.9.0.0
magentolt1.14.4.3
magentoge1.5.0.0
magentolt1.9.4.3

Name	Operator	Version
magento	ge	1.9.0.0
magento	lt	1.14.4.3
magento	ge	1.5.0.0
magento	lt	1.9.4.3

References

magento.com/security/patches/supee-11219