Magento Remote code execution through catalog attribute sets
Date: 2022-05
Affected: composer/magento/core
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2019-8230
CVE-2019-8231
CWE: CWE-94
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.


Mitigations:

Architectural layers (MAESTRO):