Common vulnerabilities and Exposures (CVE)

Skip to main content

Required CVE Record Information

Description

A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution.

Product Status

Learn more

Versions 2 Total

Default Status: unknown

affected

  • affected at Magento Open Source prior to 1.9.4.3 
  • affected at and Magento Commerce prior to 1.14.4.3 

Updated:

This container includes required additional information provided by the CVE Program for this vulnerability.