CVE-2019-8091

A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution.

Score

CVSS 3.1 7.2 High

Status

Modified - psirt@adobe.com

Published

2019-11-05

Last modified

2024-08-04

Affected products

• Magento 1 (Adobe Systems Incorporated)
• Magento (Magento)

References

• https://magento.com/security/patches/supee-11219