Design/Logic Flaw

2019-11-0600:15:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.3%

JSON

In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.

CPENameOperatorVersion
magentoge1.9.0.0
magentolt1.14.4.3
magentoge1.5.0.0
magentolt1.9.4.3

Name	Operator	Version
magento	ge	1.9.0.0
magento	lt	1.14.4.3
magento	ge	1.5.0.0
magento	lt	1.9.4.3

References

magento.com/security/patches/supee-11219